CVE-2026-19397: CWE-306: Missing Authentication for Critical Function in ASUS Control Center Express Agent
Description
CVE-2026-19397 is a high-severity vulnerability in ASUS Control Center Express Agent where a critical function lacks authentication. This flaw allows an unauthenticated nearby attacker to control the host via a direct connection to the agent if the host has an active login session. The vulnerability affects versions before 1.7.24. No known exploits are reported in the wild, and no official patch information is provided in the advisory.
CVSS v4.0
Score 7.7high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-19397 (CWE-306) involves missing authentication for a critical function in ASUS Control Center Express Agent. An unauthenticated local attacker with network access can leverage this flaw to control the host system when a user is logged in. The CVSS 4.0 base score is 7.7, indicating high severity, with attack vector being adjacent network, low attack complexity, and no privileges or user interaction required. The vulnerability affects versions prior to 1.7.24 of the software.
Potential Impact
An unauthenticated attacker on the same local network can gain control over the host system through the vulnerable ASUS Control Center Express Agent if the host has an active login session. This could lead to unauthorized system control and potential compromise of the affected machine.
Mitigation Recommendations
Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. Since no official patch link is provided, users should monitor vendor communications for updates. Until a fix is available, restricting network access to the ASUS Control Center Express Agent and limiting exposure to untrusted networks may reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x8xj-wv5r-w934
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19397"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9f9105acd9273b49ff2521
Added to database: 09/08/2026, 04:37:25 UTC
Last enriched: 09/29/2026, 05:21:22 UTC
Last updated: 10/22/2026, 13:15:20 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.