- A security researcher discovered a great failure in Asus Driverhub
- The defect allows users to execute malicious code remotely
- A patch was already launched
Driverhub, the official driver management tool of ASUS, carried a critical vulnerability that allowed the threat actors to execute malicious code on affected devices, remotely. It was recently discovered, and a patch was launched, so users are urged to apply it as soon as possible to mitigate potential risks.
ASUS DRIVERHUB is a software that automatically discharges and installs the latest ASUS devices, including laptops, base and peripheral plates. Its objective is to maintain updated devices at all times, without the need for too much manual intervention. According BleepingcomputerDriverhub is pre -installed on some devices, and is constantly executed in the background (which makes sense if it is about keeping updated software at all times).
Now, a Alias Safety researcher Mrbruh said Driverhub suffered from poorly validation of the commands. This allowed him to chain two vulnerabilities, now tracked as CVE-2025-3462 and CVE-2025-3463, and obtain the tool to execute malicious software.
Releasing the patch
He informed his findings on April 8, and Asus returned with a patch ten days later, on April 18. Although, the company says that the disruptive potential of the fault is somewhat limited: “This problem is limited to the motherboards and does not affect laptops, desktop computers or other final points,” said Asus, describing the CVE.
“Strongly recommended” users still apply the patch. “This update includes important security updates and ASUS strongly recommend that users update their installation of Asus Driverhub to the latest version,” the company said in a security warning.
“You can access the latest software update by opening ASUS Driverhub, then clicking on the” Update now “button. Ironically, the tool that manages all the controller facilities must automatically patch, manually.
According to Cyberinsider, the vulnerability window has been open for “an indeterminate period”, but since there are no reports of abuse in nature, it is safe to assume that MRBRUH was the first to detect the error.
Through Bleepingcomputer
