ASUS has issued an urgent security update for ASUS Control Center Enterprise (ACC) after researchers uncovered a maximum-severity vulnerability that lets remote attackers seize complete administrative control over the platform and every device it manages, without needing a password or any user interaction.
Tracked as CVE-2026-75754, the flaw carries a CVSS 4.0 score of 10.0, the highest possible rating, reflecting how easily it can be exploited over a network and the catastrophic scope of what an attacker can achieve once inside.
ASUS Control Center Vulnerability
The vulnerability actually stems from a chain of three separate weaknesses working together. ASUS Control Center is missing authentication on a critical function, meaning certain sensitive operations can be triggered by anyone who can reach the service over the network.
That gap is compounded by a server-side request forgery flaw, which lets an attacker send a specially crafted HTTP request to trick the system into exposing its own encryption key. Once that key is retrieved, a local service on the host automatically enables an SSH listener on TCP port 2222, effectively opening a hidden backdoor into the machine.
The final piece of the chain is arguably the most damaging: ASUS Control Center contains hard-coded credentials baked into the software itself. Attackers who obtain the encryption key can use these fixed credentials to log directly into the newly opened SSH port and land a full root shell, the highest level of system access available on the machine.
From there, intruders can read, modify, or delete any data stored in ACC, and because the platform is designed to centrally manage fleets of servers, PCs, and workstations, a single compromised ACC instance can hand attackers remote control over an entire corporate IT environment.
The flaw affects all versions of ASUS Control Center Enterprise up to and including 4.0.0.2. ASUS is urging every organization running the software to update immediately to version 3.1.0.9 or later, and confirms further fix details are posted on its official Security Advisory page.
Enterprises unable to patch right away should isolate ACC management interfaces from public networks, block inbound and outbound traffic on port 2222, and audit hosts for unexpected SSH listeners as an interim safeguard.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
