ASUS Member Center Update code download

Summaryinfo

A vulnerability classified as problematic was found in ASUS Member Center. Impacted is an unknown function of the component Update Module. Executing a manipulation can lead to code download. This vulnerability appears as CVE-2026-3428. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in ASUS Member Center (version unknown). This vulnerability affects an unknown function of the component Update Module. The manipulation with an unknown input leads to a code download vulnerability. The CWE definition for the vulnerability is CWE-494. The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOC-TOU) during the update process, where an unexpected payload is substituted for a legitimate one immediately after download, and subsequently executed with administrative privileges upon user consent. Refer to the 'Security Update for ASUS Member Center' section on the ASUS Security Advisory for more information.

The advisory is shared for download at asus.com. This vulnerability was named CVE-2026-3428 since 03/02/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/16/2026). The MITRE ATT&CK project declares the attack technique as T1495.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ASUS

Name

• Member Center

License

• commercial

Website

• Vendor: https://www.asus.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion