{"id":"CVE-2025-11901","state":"PUBLISHED","title":"An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel  B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 serie","description":"An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel  B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\nRefer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.","publishedAt":"2025-12-17T04:23:51.784Z","updatedAt":"2025-12-17T21:46:24.887Z","severity":{"score":7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"ASUS"},"assigner":"ASUS","products":["ASUS B460 series","ASUS B560 series","ASUS B660 series","ASUS B760 series","ASUS H410 series","ASUS H470 series","ASUS H510 series","ASUS H610 series","ASUS W480 series","ASUS W680 series","ASUS Z590 series","ASUS Z690 series","ASUS Z790 series"],"affected":[{"vendor":"ASUS","product":"B460 series","defaultStatus":"unaffected","versions":[{"version":"before 1805, 2002, 3002","status":"affected"}]},{"vendor":"ASUS","product":"B560 series","defaultStatus":"unaffected","versions":[{"version":"before 2402, 2803","status":"affected"}]},{"vendor":"ASUS","product":"B660 series","defaultStatus":"unaffected","versions":[{"version":"before 3810, 4501","status":"affected"}]},{"vendor":"ASUS","product":"B760 series","defaultStatus":"unaffected","versions":[{"version":"before 1825, 3102","status":"affected"}]},{"vendor":"ASUS","product":"H410 series","defaultStatus":"unaffected","versions":[{"version":"before 1805, 2002","status":"affected"}]},{"vendor":"ASUS","product":"H470 series","defaultStatus":"unaffected","versions":[{"version":"before 3002","status":"affected"}]},{"vendor":"ASUS","product":"H510 series","defaultStatus":"unaffected","versions":[{"version":"before 2402, 2803","status":"affected"}]},{"vendor":"ASUS","product":"H610 series","defaultStatus":"unaffected","versions":[{"version":"before 3810","status":"affected"}]},{"vendor":"ASUS","product":"W480 series","defaultStatus":"unaffected","versions":[{"version":"before 1002, 2603, 3302","status":"affected"}]},{"vendor":"ASUS","product":"W680 series","defaultStatus":"unaffected","versions":[{"version":"before 2015, 2701, 4501","status":"affected"}]},{"vendor":"ASUS","product":"Z590 series","defaultStatus":"unaffected","versions":[{"version":"before 2402, 2803","status":"affected"}]},{"vendor":"ASUS","product":"Z690 series","defaultStatus":"unaffected","versions":[{"version":"before 3810, 4501","status":"affected"}]},{"vendor":"ASUS","product":"Z790 series","defaultStatus":"unaffected","versions":[{"version":"before 1825, 2102, 3102","status":"affected"}]}],"references":["https://www.asus.com/security-advisory/"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/11xxx/CVE-2025-11901.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-11901","state":"PUBLISHED","datePublished":"2025-12-17T04:23:51.784Z","dateUpdated":"2025-12-17T21:46:24.887Z","assignerShortName":"ASUS","assignerOrgId":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","dateReserved":"2025-10-17T06:47:40.071Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel  B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\nRefer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information."}],"affected":[{"vendor":"ASUS","product":"B460 series","defaultStatus":"unaffected","versions":[{"version":"before 1805, 2002, 3002","status":"affected"}]},{"vendor":"ASUS","product":"B560 series","defaultStatus":"unaffected","versions":[{"version":"before 2402, 2803","status":"affected"}]},{"vendor":"ASUS","product":"B660 series","defaultStatus":"unaffected","versions":[{"version":"before 3810, 4501","status":"affected"}]},{"vendor":"ASUS","product":"B760 series","defaultStatus":"unaffected","versions":[{"version":"before 1825, 3102","status":"affected"}]},{"vendor":"ASUS","product":"H410 series","defaultStatus":"unaffected","versions":[{"version":"before 1805, 2002","status":"affected"}]},{"vendor":"ASUS","product":"H470 series","defaultStatus":"unaffected","versions":[{"version":"before 3002","status":"affected"}]},{"vendor":"ASUS","product":"H510 series","defaultStatus":"unaffected","versions":[{"version":"before 2402, 2803","status":"affected"}]},{"vendor":"ASUS","product":"H610 series","defaultStatus":"unaffected","versions":[{"version":"before 3810","status":"affected"}]},{"vendor":"ASUS","product":"W480 series","defaultStatus":"unaffected","versions":[{"version":"before 1002, 2603, 3302","status":"affected"}]},{"vendor":"ASUS","product":"W680 series","defaultStatus":"unaffected","versions":[{"version":"before 2015, 2701, 4501","status":"affected"}]},{"vendor":"ASUS","product":"Z590 series","defaultStatus":"unaffected","versions":[{"version":"before 2402, 2803","status":"affected"}]},{"vendor":"ASUS","product":"Z690 series","defaultStatus":"unaffected","versions":[{"version":"before 3810, 4501","status":"affected"}]},{"vendor":"ASUS","product":"Z790 series","defaultStatus":"unaffected","versions":[{"version":"before 1825, 2102, 3102","status":"affected"}]}],"references":[{"url":"https://www.asus.com/security-advisory/","tags":["vendor-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","baseScore":7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ASUS","orgId":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","dateUpdated":"2025-12-17T04:23:51.784Z"},"credits":[{"lang":"en","type":"reporter","value":"Mohamed Al-Sharifi  & Nick Peterson"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-17T21:46:16.833758Z","id":"CVE-2025-11901","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-17T21:46:24.887Z"}}]}}}