CVE-2025-12793 Path traversal in ASCI
A local attacker can exploit uncontrolled DLL loading in ASUS MyASUS to execute arbitrary code via a malicious DLL.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12793?
CVE-2025-12793 is a high-severity path traversal vulnerability in ASUS ASCI, published on 6 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacker-controlled location, potentially resulting in arbitrary code execution. Refer to the '
Security Update for MyASUS' section on the ASUS Security Advisory for more information.
Weakness: CWE-426
Which versions are affected by CVE-2025-12793?
It affects 1 product.
Products include Asus Myasus.
How do I fix CVE-2025-12793?
No fix has been published for CVE-2025-12793 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-12793 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12793 exists.
Other vulnerabilities in ASUS ASCI
Sources
Also known as GHSA-qf35-p6j5-89hp.