ASUS Business System Control Interface vulnerabilities

2 CVEs affecting ASUS Business System Control Interface, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-15038, published 2026-03-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-15038, published 2026-03-12. Medium severity, CVSS 6.9. EPSS: 0.1% chance of exploitation in the next 30 days. An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a specially crafted IOCTL…
CVE-2025-15037, published 2026-03-12. Medium severity, CVSS 6.8. EPSS: 0.1% chance of exploitation in the next 30 days. An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a specially…