CVE-2026-75754

Name of the Vulnerable Software and Affected Versions ASUS Control Center Enterprise versions 0 through 4.0.0.2

Description An issue involving missing authentication for critical functions, Server-Side Request Forgery (SSRF), and the use of hard-coded credentials allows an unauthenticated network attacker to obtain an encryption key via an HTTP request. This chain of weaknesses enables the attacker to trigger a local service to activate SSH on port 2222 and authenticate using embedded credentials to obtain a root shell. Successful exploitation grants the attacker full control over the ASUS Control Center, allowing them to read, write, and delete data, as well as remotely control all managed servers, PCs, and workstations within the organization.

Recommendations Update ASUS Control Center Enterprise to a version beyond 4.0.0.2. Restrict the management interface to dedicated management networks and avoid public exposure. Block unnecessary access to TCP port 2222. Monitor for unexpected SSH activation or unexplained connections to port 2222.