ASUS Fixes Critical One-Click Vulnerabilities in Preinstalled DriverHub Software

• The DriverHub driver software is a background process that communicates with a subdomain of the ASUS website.
• It does not have a GUI, but it detects and updates drivers via the dedicated server.
• An attacker could manipulate this process by enabling the execution of a crafted payload.

ASUS has rolled out updates to address two critical security flaws in its DriverHub software, which could potentially allow attackers to execute remote code on targeted systems. These vulnerabilities involve origin validation and improper certificate validation, respectively.

The issues identified as CVE-2025-3462 (CVSS score: 8.4) and CVE-2025-3463 (CVSS score: 9.4), discovered and disclosed by security researcher MrBruh, exploit the software's ability to detect and update drivers via its dedicated server, driverhub.asus[.]com. 

An attacker could manipulate this process by luring victims to a malicious subdomain, enabling the execution of a crafted payload through the misuse of an altered configuration file (AsusSetup.ini) and legitimate binaries.

The security researcher also published a PoC (proof of concept) video along with the disclosure as shown below:

Users are tricked into visiting a malicious subdomain of driverhub.asus[.]com, and the attacker leverages the “UpdateApp” endpoint to trigger the execution of infected files.  

The legitimate AsusSetup.exe binary is used in conjunction with the manipulated SilentInstallRun parameter to execute arbitrary code hosted on the attacker's site.

This attack, labeled a “one-click exploit,” could compromise a system with minimal user interaction, making it a serious threat.

ASUS promptly addressed these vulnerabilities after they were responsibly disclosed on April 8, 2025. A fix was released on May 9, 2025, and there have been no reports of the flaws being exploited in the wild. 

ASUS strongly recommends all users update their DriverHub software to the latest version to mitigate potential risks by opening ASUS DriverHub and clicking the "Update Now" button in the interface.