ASUS Control Center Express Agent missing authentication vulnerability

Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via direct connection when an active login session exists.

Disclosed 8 September 2026 · Record updated 1 October 2026

Impact

Unauthenticated nearby users can control the host via direct connection to the agent

Our coverage

A figure reaches through an open door into a control room, hands grasping at levers and switches while the rightful operator sits unaware at their station.

Vulnerabilities

ASUS agent flaw lets nearby users take over logged-in hosts

A missing authentication check in ASUS Control Center Express Agent allows control of a machine over a direct connection while a user is signed in.

14 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-x8xj-wv5r-w934