ASUS Secures DriverHub Against Sneaky RCE Attacks via HTTP and .ini Files

Summary

• Critical security vulnerability: ASUS fixed two flaws in DriverHub, tracked as CVE-2025-3462 and CVE-2025-3463, that could be chained into remote code execution.
• Exploitation method: A malicious website could send HTTP requests to DriverHub and abuse a crafted .ini file to install and run code.
• Immediate solution: ASUS released a patched version and urged users to update.
• Takeaway: Background updater tools with web access need tight origin checks.

How ASUS Patched DriverHub

ASUS has patched its DriverHub software after an independent researcher, who goes by MrBruh, showed that the driver-update tool could be hijacked from a web page. DriverHub ships on many ASUS motherboards and runs in the background, listening for requests from the company’s driver website.

The Flaw at a Glance

The tool was meant to accept requests only from ASUS sites, but its origin check could be fooled. An attacker-controlled site could then call DriverHub’s update function, point it to a crafted .ini file and get the software to install a malicious program with admin rights. A user would only need to visit the wrong page. The two bugs carry the identifiers CVE-2025-3462 and CVE-2025-3463.

ASUS’s Swift Response

ASUS shipped a fixed version after the report and asked users to update right away. Users can apply the patch through DriverHub itself. ASUS said the issue is limited to DriverHub on its motherboards and does not affect its laptops or desktop PCs.

Lessons for Software Makers

Patching speed matters, but the deeper lesson is about design. A local service that accepts commands from the browser needs strict checks on who is calling. Regular updates help; so does monitoring.

Security should be built in from the start. Fixes belong on machines the day they ship. (A quote attributed to a named analyst in an earlier version has been removed because we could not confirm it.)

What DriverHub Users Should Do

Open DriverHub and install the latest version. If you never use the tool, consider turning it off in the BIOS setting that installs it, which ASUS documents for its boards.

More software now talks to the web in the background. Keep an eye on vendor updates and keep systems patched.

Bigger Picture for Driver Tools

ASUS fixed the bug, but the case shows a recurring risk in vendor utilities that run quietly with high privileges. The industry needs security designs that hold up when an attacker controls the web page. That protects products and the trust users place in them.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.