{"id":"CVE-2025-15037","state":"PUBLISHED","title":"An Incorrect","description":"An Incorrect\nPermission Assignment vulnerability exists in the ASUS Business\nSystem Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a\nspecially crafted IOCTL request,\npotentially leading to unauthorized access to sensitive hardware resources\nand kernel information disclosure. Refer to the \"ASUS Business System Control Interface\" section on the ASUS Security Advisory for more information.","publishedAt":"2026-03-12T02:00:20.964Z","updatedAt":"2026-03-12T13:15:55.928Z","severity":{"score":6.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"ASUS"},"assigner":"ASUS","products":["ASUS ASUS Business System Control Interface"],"affected":[{"vendor":"ASUS","product":"ASUS Business System Control Interface","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.5.14.0","versionType":"custom"}]}],"references":["https://www.asus.com/content/security-advisory/"],"weaknesses":["CWE-732"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/15xxx/CVE-2025-15037.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-15037","state":"PUBLISHED","datePublished":"2026-03-12T02:00:20.964Z","dateUpdated":"2026-03-12T13:15:55.928Z","assignerShortName":"ASUS","assignerOrgId":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","dateReserved":"2025-12-23T06:48:49.410Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An Incorrect\nPermission Assignment vulnerability exists in the ASUS Business\nSystem Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a\nspecially crafted IOCTL request,\npotentially leading to unauthorized access to sensitive hardware resources\nand kernel information disclosure. Refer to the \"ASUS Business System Control Interface\" section on the ASUS Security Advisory for more information."}],"affected":[{"vendor":"ASUS","product":"ASUS Business System Control Interface","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.5.14.0","versionType":"custom"}]}],"references":[{"url":"https://www.asus.com/content/security-advisory/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6.8,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-732","lang":"en","description":"CWE-732 Incorrect Permission Assignment for Critical Resource","type":"CWE"}]}],"providerMetadata":{"shortName":"ASUS","orgId":"54bf65a7-a193-42d2-b1ba-8e150d3c35e1","dateUpdated":"2026-03-12T02:00:20.964Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:asus:asus_business_system_control_interface:*:*:*:*:*:*:*:*","versionEndExcluding":"0.5.14.0","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-12T13:15:48.452586Z","id":"CVE-2025-15037","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-12T13:15:55.928Z"}}]}}}