CVE-2023-26911

Name of the Vulnerable Software and Affected Versions Asus Armoury Crate version 5.3.4.0 SetupAsusServices version 1.0.5.1

Description The issue is related to an unquoted service path vulnerability in the SetupAsusServices module of Asus Armoury Crate. This vulnerability allows local users to launch processes with elevated privileges. The lack of quotes in the service path elements or search paths can be exploited by an attacker to gain higher privileges.

Recommendations For Asus Armoury Crate version 5.3.4.0, consider updating to a newer version that addresses the unquoted service path vulnerability in SetupAsusServices. For SetupAsusServices version 1.0.5.1, update to a version that properly quotes service paths to prevent exploitation. As a temporary workaround, consider restricting access to the SetupAsusServices module to minimize the risk of exploitation.