CVE-2026-75809 in Armoury Crate
Summary
by MITRE • 09/08/2026
Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in ASUS Armoury Crate represents a critical failure in operating system level access control mechanisms, specifically within the input/output control (IOCTL) interface of its associated kernel-mode driver. This flaw stems from an insufficient verification process when handling IOCTL requests sent by local users to the device driver. In standard Windows architecture, drivers operate with high privileges and can interact directly with hardware components via memory-mapped I/O or PCI configuration spaces. The Armoury Crate driver fails to adequately validate whether the requesting user possesses the necessary administrative rights or security tokens before executing these low-level commands. This lack of authentication allows any authenticated local user, regardless of their privilege level, to invoke specific IOCTL codes that are intended for system administrators only. By bypassing this critical gatekeeping mechanism, an attacker can execute operations that should be restricted to trusted entities with elevated permissions.
The technical exploitation of this flaw involves direct interaction with the Peripheral Component Interconnect Express (PCIe) configuration space through these unauthenticated IOCTL calls. The PCIe configuration space contains vital hardware identification registers and control bits that dictate how devices behave on the system bus. By writing arbitrary values to specific offsets within this space, an attacker can alter device parameters, disable network interfaces, or cause other peripherals to malfunction effectively denying service to legitimate users. Furthermore, reading from these same memory regions allows for the disclosure of sensitive hardware information, such as vendor IDs, device IDs, and potentially internal state data that could aid in further exploitation attempts against more complex systems. This capability transforms a simple local application flaw into a potent tool for both reconnaissance and denial-of-service attacks without requiring any elevation of privilege beyond standard user access.
From an operational impact perspective, this vulnerability compromises the integrity and availability of the host system while also posing risks to confidentiality depending on what data resides in the accessible PCIe registers. An attacker can disrupt normal computer operations by disabling critical hardware components such as Wi-Fi adapters or storage controllers, leading to immediate service disruption. Additionally, the ability to read from the configuration space may expose information that aids in crafting more sophisticated attacks against other software running on the machine or even physical layer security mechanisms if specific hardware features are exposed. For enterprise environments relying on ASUS devices for their infrastructure, this represents a significant risk vector where insider threats or compromised low-privilege accounts can lead to substantial system instability and data exposure without triggering typical privilege escalation alerts since no elevation is technically required.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-269 Improper Privilege Management, as the core issue lies in the failure to enforce proper access controls on privileged operations. It also maps closely to MITRE ATT&CK technique T1055 Process Injection or more specifically hardware-level interactions akin to direct memory access patterns often seen in advanced persistent threats seeking low-level system control. The specific action of reading and writing PCIe configuration space is characteristic of techniques used to manipulate device behavior for persistence or disruption, falling under the broader umbrella of peripheral device manipulation found in frameworks like ATT&CK's Device Driver Discovery and Hardware Abstraction Layer interactions.
To mitigate this risk, users must apply the security update provided by ASUS as detailed in their official Security Advisory for Armoury Crate App. This patch likely implements stricter checks within the driver code to verify user privileges before allowing IOCTL requests that interact with PCIe configuration spaces. Administrators should ensure that all systems running affected versions of Armoury Crate are updated immediately upon availability. In environments where immediate patching is not feasible, restricting local login capabilities or applying application whitelisting policies can help prevent unauthorized execution of the vulnerable driver components. Regular auditing of installed drivers and monitoring for unusual IOCTL activity using endpoint detection and response tools can also provide early warning indicators of exploitation attempts targeting this specific weakness.