ASUS has rolled out an emergency security patch for its ASUS Control Center Enterprise (ACC) software following the discovery of a critical vulnerability that gives remote attackers full administrative control over the system—no password or user interaction needed. The issue is identified as CVE-2026-75754 and carries a perfect CVSS 4.0 score of 10.0, underscoring both its ease of exploitation over networks and the severity of its impact.
Flaw Breakdown: How Attackers Can Seize Control
The breach is the result of three intertwined weaknesses in ACC. First, the management console lacks authentication for a key internal function, allowing access to sensitive operations without valid credentials from anyone reaching the service.
Second, a Server-Side Request Forgery (SSRF) vulnerability makes it possible to send a specially crafted HTTP request, which tricks the system into revealing its own encryption key. Once attackers have that key, the third flaw kicks in.
Thirdly, ACC has hard-coded credentials embedded in the software. Armed with the encryption key, attackers can connect to a backend service preconfigured to activate an SSH listener on TCP port 2222. These credentials grant them a root shell—complete control over the ACC instance and any devices it manages.
Scope, Impact & Recommended Protections
This vulnerability affects all versions of ACC up through 4.0.0.2. ASUS urges users to immediately upgrade to version 3.1.0.9 or above. For those who can’t patch right away, temporary safeguards include isolating management interfaces from any public network, blocking traffic on port 2222, and scanning hosts for unknown SSH listeners.
Because ACC is used by organizations to centrally manage networks of servers, PCs, and workstations, one compromised instance could provide attackers with unrestricted access across an entire IT infrastructure.
Additional details about mitigation, patch timelines, and impacted versions are published on ASUS’s security advisory page.
Analysis: This vulnerability is especially dangerous because of its chain-reaction nature. Each flaw alone might be manageable, but together they create a zero-interaction, high-privilege breach path. Enterprises that rely on ACC ought to treat this as an immediate priority—not only patching, but revisiting network design and credential management practices. Going forward, software that centralizes control like ACC must ensure that even internal functions are safeguarded by authentication, and hard-coded credentials must be eliminated to prevent similar catastrophic risks.
