CVE-2025-13348

Severity: high (CVSS 8.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-02 · updated 2026-06-17
Weakness: CWE-862

Description

An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered by a local user sending a specially crafted request, potentially leading to the creation of arbitrary files in a specified path. Refer to the "Security Update for ASUS Business Manager" section on the ASUS Security Advisory for more information.

Affected products

ASUS Business Manager: before 3.0.37.0 — fixed in 3.0.37.0

How to fix

Upgrade to a fixed version: ASUS Business Manager 3.0.37.0. Check the vendor advisory for mitigations.

References

https://www.asus.com/security-advisory/

Get alerted when CVE-2025-13348 or the next vulnerability affects your stack