CVE-2026-19397: Unauthenticated RCE in ASUS Control Center Express Agent

ASUS has patched a remote code execution vulnerability in its enterprise IT management agent, disclosed on September 10, 2026, via advisory ZDI-26-657. The flaw allows an attacker to take over managed workstations without credentials by exploiting a proprietary Remote Desktop endpoint. The case raises a significant technical question: is the risk truly "remote" across the global internet, or limited to intruders already inside the corporate perimeter?

The Mechanism: A Forgotten Endpoint Without Access Control

The root of the vulnerability lies in a sparsely documented proprietary interface. According to advisory ZDI-26-657, the ASUS Control Center Express Agent exposes an endpoint named Remote Desktop listening on TCP port 10637 by default. The specific defect is the lack of authentication before granting access to control functions: anyone reaching that port gains operational capabilities equivalent to a local administrator physically logged in.

The official CVE Record classifies the vulnerability as CWE-306, "Missing Authentication for Critical Function." The CVE description specifies that an unauthenticated "nearby" user can control the host via a direct connection to the agent, provided an active login session exists on the machine. This detail — the presence of a user logged in at the console — defines the execution context: the malicious code runs with the privileges of that user, not necessarily as SYSTEM or root.

The CVSS Divergence: Same Flaw, Two Risk Perimeters

The case presents a rare discrepancy between reliable primary sources. Zero Day Initiative assigns the vulnerability a CVSS score of 9.8, typically associated with network-executable attacks (Attack Vector: Network) requiring no user interaction and no privileges. The official CVE record, however, publishes a CVSS 4.0 score of 7.7 with an explicit AV:A vector, meaning "Adjacent Network": this technically limits the danger zone to an attacker positioned on the same local network, for example via corporate Wi-Fi or a segmented LAN, but not arbitrarily reachable from the internet.

"Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session." — CVE Record CVE-2026-19397

The two assessments are not semantically incompatible, but they produce distinct operational effects. A "network" CVSS 9.8 typically triggers emergency response protocols and maximum patching priority; a 7.7 "adjacent" may instead be classified as a manageable risk within the ordinary update cycle. Neither source in the dossier explains the reason for the difference, nor do ZDI or CVE.org publish a comparative scoring analysis. For enterprises, this ambiguity turns a technically neutral assessment into a risk governance problem.

Immediate Actions

• Verify the presence of the ASUS Control Center Express Agent on workstations and notebooks in the IT inventory, focusing on those with persistent or unlocked user sessions.
• Block TCP port 10637 at the host firewall and network segment level, preventing unauthorized connections even while awaiting the official patch.
• Apply the update released by ASUS, noted as available in the ZDI advisory, verifying that the vendor has published specific release notes for the relevant model or version.
• Review connection logs for port 10637 over the last 90 days to detect anomalous access, considering the coordinated disclosure period began in June 2026.

Enterprise Context: When the Management Agent Becomes Attack Surface

ASUS Control Center Express is a centralized IT management platform typically deployed in small and medium business environments, where dedicated security resources are scarce. This profile makes a pre-authentication flaw particularly dangerous: monitoring tools may not be tuned to detect suspicious activity on non-standard ports like 10637, interpreting the traffic as legitimate remote administration.

The combination of RCE with console user context and no authentication amplifies lateral movement risk. An attacker compromising a workstation can leverage the active session to access shared resources, cached credentials, or enterprise authentication tokens. The fact that the attack requires no end-user interaction — confirmed by the UI:N parameter in both scorings — eliminates the traditional security filter represented by social engineering.

However, gray areas remain in the dossier. Specific affected product versions are not detailed in the ZDI advisory. No evidence of active in-the-wild exploitation emerges. The direct ASUS patch URL is not provided in the primary document, which refers generically to "more details" without a specific link. The Remote Desktop protocol implemented by the agent is not detailed: it could be a proprietary RDP extension, a modified VNC protocol, or a completely custom channel.

Why the "Remote" Discrepancy Matters More Than the Score

The distance between "network" and "adjacent" is not semantic. It determines whether the vulnerability falls within an organization's internet-facing exposure perimeter or remains confined to the internal network. Many enterprise infrastructures carefully segment public-facing servers but leave endpoint management agents exposed inside the LAN, sometimes with guest Wi-Fi access. If the CVE "adjacent" assessment is technically correct, the risk narrows to insiders, physical guests, or prior compromises. If ZDI is correct in signaling a broader vector, the attack surface expands to any routable entity.

Neither source in the dossier clarifies this point. Enterprises using ASUS Control Center Express must therefore proceed with calibrated caution: treat the vulnerability as if the vector were network until proven otherwise, but do not assume internet exposure without evidence of scanning or exploitation.

The discrepancy itself is a warning signal on the state of standardized risk assessment. CVSS 4.0 was introduced precisely to refine scoring granularity, introducing metrics like Attack Requirements and User Interaction. That the same CVE identifier generates such divergent interpretations between a specialized advisory and the official registry suggests the transition to the new standard is still unstable, and that security teams cannot rely solely on the number to prioritize.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-657/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-19397
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html

Information verified against cited sources and current as of publication.

Sources