ASUS Member Center Privilege Escalation Vulnerability

A vulnerability allowing privilege escalation to Administrator has been identified in the update modules of ASUS Member Center, versions through 1.6.6.4. This vulnerability arises from a download of code without integrity checks, exploiting a Time-of-check Time-of-use (TOC-TOU) issue during the update process. A local user can substitute an unexpected payload for a legitimate one immediately after download, which is then executed with administrative privileges upon user consent.

Impact

Exploitation of this vulnerability allows a local user to gain administrative privileges on the affected system.

Remediation

Users can refer to the 'Security Update for ASUS Member Center' section on the ASUS Security Advisory for update instructions.