CVE-2026-3428
TOC-TOU Code Download Flaw in ASUS Member Center Enables Privilege Escalation
Publication date: 2026-04-16
Last updated on: 2026-04-16
Assigner: ASUS
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| asus | member_center | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-494 | The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
| CWE-367 | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Download of Code Without Integrity Check issue in the update modules of ASUS Member Center. It allows a local user to escalate their privileges to Administrator by exploiting a Time-of-check Time-of-use (TOC-TOU) race condition during the update process.
Specifically, after a legitimate payload is downloaded, an attacker can substitute it with an unexpected payload before execution. When the user consents, this malicious payload is executed with administrative privileges.
How can this vulnerability impact me? :
This vulnerability can allow a local attacker to gain administrative privileges on the affected system.
With elevated privileges, the attacker could execute arbitrary code with full control over the system, potentially leading to unauthorized access, data modification, or system compromise.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that you apply the latest security updates provided by ASUS for the ASUS Member Center software.
Avoid running the update process with lower privileges that could be exploited, and be cautious when consenting to update prompts.