CVE-2026-75754

What it is

Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company. Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-08-18 02:09 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-09-04 03:17 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-09-17 09:16 UTC Last updatedMost recent change to the record

Details

Published

2026-09-04 03:17 UTC

Last modified

2026-09-17 09:16 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-306 · Missing authentication

Record status

Deferred

Attack profile CVSS 4.0 · 10.0

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High