ZDI 2026-09-10

ZDI-26-657: ASUS Control Center Express Agent Missing Authentication Remote Code Execution Vulnerability

CVE-2026-19397

Machine-generated analysis · WAYSCloud LLM

ASUS Control Center Express Agent can be remotely exploited without authentication.

Context

The advisory concerns the ASUS Control Center Express Agent. It describes a remote code execution vulnerability that requires no authentication. The issue is assigned CVSS 9.8 (CVE-2026-19397).

Operator considerations

Check: inventory installations of ASUS Control Center Express Agent.
Isolate: consider network segmentation for systems running the agent until mitigation is available.
Log: enable logging of remote connections to the agent if possible.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ASUS Control Center Express Agent. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19397.

Read the full advisory on ZDI →