A high-severity vulnerability in ASUS Armoury Crate software could allow threat actors to escalate their privileges to SYSTEM level on Windows machines.
The security issue is tracked as CVE-2025-3464 and received a severity score of 8.8 out of 10.
It could be exploited to bypass authorization and affects the AsIO3.sys of the Armoury Crate system management software.
Armoury Crate is the official system control software for Windows from ASUS, providing a centralized interface to control RGB lighting (Aura Sync), adjust fan curves, manage performance profiles and ASUS peripherals, as well as download drivers and firmware updates.
To perform all these functions and provide low-level system monitoring, the software suite uses the kernel driver to access and control hardware features.
Cisco Talos' researcher Marcin "Icewall" Noga reported CVE-2025-3464 to the tech company.
According to a Talos advisory, the issue lies in the driver verifying callers based on a hardcoded SHA-256 hash of AsusCertService.exe and a PID allowlist, instead of using proper OS-level access controls.
Exploiting the flaw involves creating a hard link from a benign test app to a fake executable. The attacker launches the app, pauses it, and then swaps the hard link to point to AsusCertService.exe.
When the driver checks the file's SHA-256 hash, it reads the now-linked trusted binary, allowing the test app to bypass authorization and gain access to the driver.
This grants the attacker low-level system privileges, giving them direct access to physical memory, I/O ports, and model-specific registers (MSRs), opening the path to full OS compromise.
... continue reading