ASUS has released a crucial security update for its ASUS Control Center Enterprise software after researchers identified a severe vulnerability. This flaw, designated as CVE-2026-75754, allows remote attackers to gain full administrative control over the system and any connected devices without requiring a password or user interaction. The vulnerability has been assigned the highest possible CVSS 4.0 score of 10.0, highlighting its ease of exploitation and the potential damage it can cause.
The issue arises from a combination of three weaknesses. First, the absence of authentication on a critical function within ASUS Control Center enables unauthorized access to sensitive operations. This vulnerability is further exacerbated by a server-side request forgery flaw, which permits attackers to manipulate the system into revealing its encryption key through a specially crafted HTTP request. Once the encryption key is obtained, a local service on the host inadvertently activates an SSH listener on TCP port 2222, creating a covert entry point into the system.
The most concerning aspect of this flaw is the presence of hard-coded credentials within the ASUS Control Center software. Attackers can use these fixed credentials, along with the encryption key, to directly access the SSH port, granting them full root shell control. This level of access allows intruders to read, modify, or delete data within the ACC. Given the platform's role in managing a wide range of servers, PCs, and workstations, a single compromised instance could grant attackers control over an entire corporate IT environment.
The vulnerability affects all versions of ASUS Control Center Enterprise up to version 4.0.0.2. ASUS is strongly advising organizations to update to version 3.1.0.9 or later immediately. For those unable to patch right away, ASUS recommends isolating ACC management interfaces from public networks, blocking traffic on port 2222, and auditing for unexpected SSH listeners as temporary protective measures. More detailed information is available on ASUS's official Security Advisory page.
