CVE-2026-75754: CWE-306 Missing authentication for critical function in ASUS Control Center Enterprise (ACC)

This vulnerability (CVE-2026-75754) in ASUS Control Center Enterprise (ACC) combines multiple weaknesses: missing authentication for a critical function (CWE-306), server-side request forgery (CWE-918), and use of hard-coded credentials (CWE-798). Exploitation allows an unauthenticated attacker to retrieve an encryption key through an HTTP request, causing a local service to activate SSH access on port 2222. Using the hard-coded credentials, the attacker gains root shell access, enabling complete read, write, and deletion capabilities on the ASUS Control Center and remote control over all connected endpoints within the company environment. The CVSS 4.0 base score is 10.0, reflecting the critical impact and ease of exploitation without privileges or user interaction.

Successful exploitation results in full root-level access to the ASUS Control Center and all managed servers, PCs, and workstations within the affected environment. This includes the ability to read, modify, or delete data and remotely control all connected devices, posing a severe risk to confidentiality, integrity, and availability of enterprise systems.

Patch status is not yet confirmed — check the ASUS Security Advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, organizations should consider restricting network access to ASUS Control Center, monitoring for unusual SSH activity on port 2222, and applying compensating controls to limit exposure. Do not rely on the product's default configurations given the presence of hard-coded credentials.