This vulnerability arises from the lack of integrity verification on code downloaded during the update process of ASUS Member Center (华硕大厅). A local attacker can exploit a TOC-TOU race condition to replace the legitimate update payload with a malicious one after download but before execution. Because the update process runs with administrative privileges and requires user consent, the attacker can escalate privileges to Administrator by tricking the system into executing the substituted payload. The affected versions are 1.6.6.4 and earlier. The CVSS 4.0 vector indicates local attack vector, high attack complexity, partial user interaction, and partial impact on confidentiality, integrity, and availability.

Successful exploitation allows a local user with limited privileges to escalate to Administrator privileges on the affected system. This can lead to full control over the system, including installation of malicious software or modification of system settings. The vulnerability does not appear to be exploitable remotely and requires user interaction. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is released, users should exercise caution when applying updates via ASUS Member Center and avoid running update processes from untrusted environments. Monitoring for updates from ASUS is recommended to apply any forthcoming patches promptly.