Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-75754

Control Center Enterprise (ACC) · Vulnerability

CVSS 4.0 10.0 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-75754

Published

Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company. Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-75754

Published

Control Center Enterprise (ACC)

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ASUS",
                    "product": "Control Center Enterprise (ACC)",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "through 4.0.0.2",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON