CVE-2026-75754: CWE-306 Missing authentication for critical function in ASUS Control Center Enterprise (ACC)

This vulnerability in ASUS Control Center Enterprise (ACC) combines multiple security weaknesses: missing authentication for a critical function, SSRF, and hard-coded credentials. Exploitation allows an unauthenticated attacker to retrieve an encryption key through an HTTP request, causing a local service to activate SSH access on port 2222. Using hard-coded credentials, the attacker can log in with root privileges, enabling unrestricted access to read, write, delete data on the management platform, and remotely control all managed endpoints within the enterprise environment. The CVSS 4.0 score is 10.0, reflecting the critical severity and ease of exploitation without authentication or user interaction.

Successful exploitation results in complete compromise of the ASUS Control Center Enterprise management platform and all connected devices. The attacker gains root shell access, enabling full data manipulation and remote control of servers, PCs, and workstations managed by the platform. This represents a total loss of confidentiality, integrity, and availability for the affected environment.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Until an official fix is released, restrict network access to the ASUS Control Center management interface and monitor for unusual SSH activity on port 2222. Avoid exposing the management platform to untrusted networks. Follow ASUS vendor advisories closely for updates.