{"id":"CVE-2026-112116","title":"An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complet…","summary":"An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complet…","severity":"high","cvss":8.5,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-782"],"vendor":"ASUS","product":"System Control Interface","affected":["system_control_interface >= 3.1.66.0 <= 3.1.69.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-04T14:55:06.580995Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T15:18:57.896Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112116","references":[{"url":"https://www.asus.com/security-advisory"}],"tags":["cve.org"],"epss":0.00107,"epssPercentile":0.01131,"ingestedAt":"2026-11-05T21:36:00.438Z","slug":"CVE-2026-112116","body":"## Overview\n\nAn exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the affected system.\nRefer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.\n\n## Affected\n\n- `system_control_interface >= 3.1.66.0 <= 3.1.69.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":46.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}