CVE-2025-11901

Severity: high (CVSS 7.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-17 · updated 2026-10-07
Weakness: CWE-284

Description

An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA). Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.

Affected products

ASUS B460 series: before 1805, 2002, 3002
ASUS B560 series: before 2402, 2803
ASUS B660 series: before 3810, 4501
ASUS B760 series: before 1825, 3102
ASUS H410 series: before 1805, 2002
ASUS H470 series: before 3002
ASUS H510 series: before 2402, 2803
ASUS H610 series: before 3810
ASUS W480 series: before 1002, 2603, 3302
ASUS W680 series: before 2015, 2701, 4501
ASUS Z590 series: before 2402, 2803
ASUS Z690 series: before 3810, 4501
ASUS Z790 series: before 1825, 2102, 3102

References

https://www.asus.com/security-advisory/

Get alerted when CVE-2025-11901 or the next vulnerability affects your stack