The Asus tool PC gamers use to update drivers, fix bugs, and improve security, turns out to have a bit of a security issue itself

2025-05-15 12:04:00
www.pcgamer.com

Driver updates—yes, I know they’re not fun, but we’ve all got to do them. At the very least, they’re somewhat less nerve-wracking than a BIOS update; I know I really should do those more often, too, but the thought of something going awry part-way through just makes me queasy. Asus at least has a driver tool called DriverHub to make things easier. Unfortunately, a recent Hub bug may have left the back door open to hackers.

If you’ve got an Asus motherboard or an otherwise prebuilt system, you should update DriverHub now, as your system may be at risk of a remote code execution attack (via Hot Hardware).

Simply put, DriverHub acts like an open network server in your machine, looking for HTTP requests and validating the ones that directly come from driverhub.asus.com. Unfortunately, if we think of DriverHub as a somewhat exclusive club, it needs to fire its bouncer as it will also let in driverhub.asus.com.but.with.funny.glasses.and.a.trenchcoat.com.

Turns out this driver tool is not as secure as anyone would like. If someone were to set up my aforementioned, creatively named domain, all they’d then need to do would be to upload a file containing a genuine Asus installer with administrator permissions alongside malicious files of their choice. This is because DriveHub only validates the digital signature of the installer, but none of the files that the executable is hoping to install on your system.

To deploy the club metaphor once more, DriveHub’s bouncer waves in someone who is clearly not Asus, and then the security at bag check looks them over, goes, ‘Yup, that’s definitely a very fashionable trenchcoat,’ but doesn’t look in any of their pockets. The impostor then saunters towards the VIP room to make a royal mess that I definitely wouldn’t want to be tasked with cleaning up.

A close up photo of the Asus ROG Maximus Z890 Hero motherboard

(Image credit: Future)

Unfortunately, this party-crashing bug isn’t as new or as surprising as some might hope. A security researcher going by the handle MrBruh recently detailed the vulnerability before disclosing it to Asus. However, it turns out the company may have known about the issue as early as February after another researcher, “leonjza”, also brought it to their attention.

Still, the vulnerability was registered with NIST as CVE-2025-3462 and CVE-2025-3463 last week, and both have the dubious honour of a high CVSS-B score (8.4 and 9.4 respectively).

Thankfully, it’s easy enough to update from within DriverHub itself. Alternatively, if you had already turned off automatic update installs directly within your BIOS, thereby likely avoiding the bug, you’re allowed to feel just a bit smug.

As much as I’d rather put off BIOS updates—especially after writing about this ill-fated 100-hour update recently—I should probably get comfortable poking around in there myself. Turning off automatic installation might present a bit of a faff in the short term, but with Nvidia issuing GPU driver hotfixes to earlier hotfixes that also fail to fix, it might just be worth my while.

Source Link

Take your gaming to the next level! The Redragon S101 RGB Backlit Gaming Keyboard is an Amazon’s Choice product that delivers incredible value. This all-in-one PC Gamer Value Kit includes a Programmable Backlit Gaming Mouse, perfect for competitive gaming or casual use.

With 46,015 ratings, an average of 4.6 out of 5 stars, and over 4K+ bought in the past month, this kit is trusted by gamers everywhere! Available now for just $39.99 on Amazon. Plus, act fast and snag an exclusive 15% off coupon – but hurry, this offer won’t last long!

Score this incredible deal now!

Start your free Amazon Prime trial
today and unlock unlimited streaming and more!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!

BITCOIN

Bitcoin Logo