CVE-2026-12962 in Armoury Crate
Summary
by MITRE • 09/08/2026
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Asus Armoury Crate represents a critical failure in cross-origin resource sharing policies, specifically categorized under CWE-942 as Permissive Cross-domain Security Policy with Untrusted Domains. This flaw arises from an overly permissive configuration of the browser-based security model utilized by the application's local service endpoint. Instead of restricting access to trusted origins or implementing strict same-origin policy checks, the application allows requests from arbitrary external domains. This misconfiguration effectively bypasses standard web security boundaries that are designed to prevent malicious websites from accessing sensitive data hosted on a user’s local machine through privileged applications.
The operational mechanism of this exploit relies on social engineering combined with technical exploitation of the permissive CORS settings. A remote attacker constructs a malicious webpage containing specific code designed to interact with Armoury Crate's local service endpoint. By leveraging Cross-Site Request Forgery techniques, the attacker crafts a request that includes a Universal Naming Convention path. When an unsuspecting user visits this crafted page while logged into or having active sessions within Armoury Crate, their browser automatically attaches authentication credentials, such as NTLM hashes, to the outgoing request due to standard HTTP behavior regarding local network resources. The permissive security policy of the application fails to reject this cross-origin request, allowing it to reach the internal service endpoint and process the sensitive credential data.
The impact of this vulnerability is severe, primarily because it facilitates the theft of NTLM hashes from the local user's system. NTLM hashes are a form of password-equivalent information that can be used in pass-the-hash attacks to authenticate to other systems on the network without needing the plaintext password. This significantly lowers the barrier for lateral movement within an enterprise environment or unauthorized access to remote services. The attacker does not need direct network access to the victim's machine; instead, they rely on the user visiting a malicious website, making this a high-risk web-based attack vector that can lead to full system compromise if the stolen credentials are used against vulnerable targets.
Mitigation strategies must focus on tightening the security configuration of Armoury Crate and enhancing user awareness. The primary technical fix involves updating the application to version where ASUS has addressed these permissive cross-domain policies, ensuring that only trusted origins are allowed to make requests to local service endpoints. Administrators should verify that the latest security patches provided in the Asus Security Advisory for Armoury Crate App are installed immediately. Additionally, users should be educated about the risks of visiting untrusted websites while running privileged applications or maintaining active sessions with system utilities. Implementing network-level controls such as restricting access to localhost services from external interfaces can also provide an additional layer of defense against this type of exploitation.