CVE-2026-7480: An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privileges to SYSTEM and execute arbitrary code via a crafted RPC call that bypass the validation mechanism

Synopsis

Incorrect permission assignment on a critical resource in ASUS System Control Interface lets a local user elevate to SYSTEM by issuing a crafted RPC call that bypasses the validation mechanism. The attacker needs an existing low-privileged account on the host and no user interaction, and successful exploitation yields full SYSTEM-level arbitrary code execution. No fix is published yet, and HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  AV:L means the attacker needs an existing shell or process on the host; there is no network-facing entry point.

• AuthenticationRequired

  PR:L means any low-privileged local account on the system is sufficient to launch the RPC call.

• Victim interactionNot required

  UI:N means no user has to click, open, or approve anything for the exploit to succeed.

• Attack complexityDetail

  AC:H indicates the exploit depends on environmental factors such as race timing or specific system state to reliably bypass the validation mechanism.

Blast Radius

• Executes arbitrary code as SYSTEM, giving the attacker full control over the Windows host.
• Reads any file or process memory on the system, including credentials and protected configuration.
• Modifies or replaces operating-system binaries, services, and persistence mechanisms.
• Disrupts or disables security tooling and other services running on the host.