CVE-2025-11901 (GCVE-0-2025-11901)

Vulnerability from cvelistv5 – Published: 2025-12-17 04:23 – Updated: 2025-12-17 21:46
VLAI?
Summary
An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA). Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.
Severity ?
7 (High)
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
ASUS B460 series Affected: before 1805, 2002, 3002
Create a notification for this product.
Credits
Mohamed Al-Sharifi & Nick Peterson
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11901",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T21:46:16.833758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T21:46:24.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "B460 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 1805, 2002, 3002"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "B560 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 2402, 2803"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "B660 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 3810, 4501"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "B760 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 1825, 3102"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "H410 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 1805, 2002"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "H470 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 3002"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "H510 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 2402, 2803"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "H610 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 3810"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "W480 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 1002, 2603, 3302"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "W680 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 2015, 2701, 4501"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Z590 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 2402, 2803"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Z690 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 3810, 4501"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Z790 series",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "before 1825, 2102, 3102"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mohamed Al-Sharifi  \u0026 Nick Peterson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;Intel  B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e. \u003c/span\u003eExploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\u003cbr\u003eRefer to the \u0027Security Update for UEFI firmware\u0027 section on the ASUS Security Advisory for more information.\n\n\u003cbr\u003e"
            }
          ],
          "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\u00a0Intel  B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\nRefer to the \u0027Security Update for UEFI firmware\u0027 section on the ASUS Security Advisory for more information."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "PHYSICAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-17T04:23:51.784Z",
        "orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
        "shortName": "ASUS"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.asus.com/security-advisory/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
    "assignerShortName": "ASUS",
    "cveId": "CVE-2025-11901",
    "datePublished": "2025-12-17T04:23:51.784Z",
    "dateReserved": "2025-10-17T06:47:40.071Z",
    "dateUpdated": "2025-12-17T21:46:24.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-11901\",\"sourceIdentifier\":\"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\",\"published\":\"2025-12-17T05:16:10.793\",\"lastModified\":\"2025-12-18T15:08:06.237\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\u00a0Intel  B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\\nRefer to the \u0027Security Update for UEFI firmware\u0027 section on the ASUS Security Advisory for more information.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"references\":[{\"url\":\"https://www.asus.com/security-advisory/\",\"source\":\"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-11901\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-12-17T21:46:16.833758Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-12-17T21:46:20.739Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Mohamed Al-Sharifi  \u0026 Nick Peterson\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"ASUS\", \"product\": \"B460 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 1805, 2002, 3002\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"B560 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 2402, 2803\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"B660 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 3810, 4501\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"B760 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 1825, 3102\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"H410 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 1805, 2002\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"H470 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 3002\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"H510 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 2402, 2803\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"H610 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 3810\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"W480 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 1002, 2603, 3302\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"W680 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 2015, 2701, 4501\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"Z590 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 2402, 2803\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"Z690 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 3810, 4501\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"ASUS\", \"product\": \"Z790 series\", \"versions\": [{\"status\": \"affected\", \"version\": \"before 1825, 2102, 3102\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.asus.com/security-advisory/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\\u00a0Intel  B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\\nRefer to the \u0027Security Update for UEFI firmware\u0027 section on the ASUS Security Advisory for more information.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u0026nbsp;Intel  B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e. \u003c/span\u003eExploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\u003cbr\u003eRefer to the \u0027Security Update for UEFI firmware\u0027 section on the ASUS Security Advisory for more information.\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\", \"shortName\": \"ASUS\", \"dateUpdated\": \"2025-12-17T04:23:51.784Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-11901\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-12-17T21:46:24.887Z\", \"dateReserved\": \"2025-10-17T06:47:40.071Z\", \"assignerOrgId\": \"54bf65a7-a193-42d2-b1ba-8e150d3c35e1\", \"datePublished\": \"2025-12-17T04:23:51.784Z\", \"assignerShortName\": \"ASUS\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.