CVE-2026-75809: CWE-782: Exposed IOCTL with Insufficient Access Control in ASUS Armoury Crate

This vulnerability (CVE-2026-75809) in ASUS Armoury Crate arises from exposed IOCTL interfaces that lack sufficient access control. A local attacker with limited privileges can bypass driver authentication mechanisms and leverage IOCTL commands to access PCIe configuration space for reading and writing. This can lead to information disclosure and disruption of device functionality. The CVSS 4.0 base score is 5.9, reflecting medium severity with local attack vector, high attack complexity, and limited privileges required. No vendor patch or remediation details are provided in the input data.

A local attacker can bypass driver authentication to access PCIe configuration space via IOCTL calls, potentially disclosing sensitive information and disabling device functionality. The impact is limited to local users with some privileges and requires complex attack conditions. No evidence of active exploitation is known.

Patch status is not yet confirmed — check the ASUS Security Advisory for Armoury Crate for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for updates from ASUS.