This vulnerability (CVE-2026-7480) affects ASUS System Control Interface versions up to and including 3.1.59.0. It is caused by incorrect permission assignment (CWE-732) on a critical resource, which allows a local attacker with limited privileges to escalate to SYSTEM privileges by sending a specially crafted RPC call that bypasses validation checks. The CVSS 4.0 base score is 7.3, reflecting a high-severity local privilege escalation with high attack complexity and high impact on confidentiality, integrity, and availability. ASUS has not provided an official patch or remediation guidance as of the publication date, and no exploits are known in the wild.

A local attacker with limited privileges can exploit this vulnerability to gain SYSTEM-level privileges on the affected system. This elevation of privilege could allow the attacker to perform unauthorized actions with the highest system privileges, potentially compromising system integrity and confidentiality. However, exploitation requires local access and crafting a malicious RPC call, and no active exploitation has been reported.

No official patch or remediation guidance is currently available from ASUS. Users should monitor ASUS advisories for updates. In the absence of a patch, restricting local user access and limiting exposure to untrusted users may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.