ASUS Aura Sync vulnerabilities

3 CVEs affecting ASUS Aura Sync, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-25764, published 2026-07-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-17603, published 2020-06-02. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows local users to cause a denial of service (system crash) or…
CVE-2022-44898, published 2022-12-14. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, and 0x80102054, allowing attackers to trigger a memory…
CVE-2019-25764, published 2026-07-17. High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days. **UNSUPPORTED WHEN ASSIGNED** Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs,…