CVE-2024-30804: ASUS Fan_Xpert RCE Vulnerability

CVE-2024-30804 Overview

CVE-2024-30804 is a driver vulnerability in the DeviceIoControl component of ASUS Fan_Xpert versions prior to v10013. The flaw allows attackers to execute arbitrary code by sending crafted Input/Output Control (IOCTL) requests to the vulnerable driver. The issue is classified under CWE-782: Exposed IOCTL with Insufficient Access Control. ASUS Fan_Xpert is a utility distributed with ASUS hardware to manage fan speeds and thermal profiles, and its kernel-mode driver exposes IOCTL interfaces to user-space callers. Because the driver does not adequately restrict or validate IOCTL handlers, an attacker reaching the device interface can leverage it to achieve code execution.

Critical Impact
A successful attack against the exposed IOCTL handler can result in arbitrary code execution with the privileges of the vulnerable kernel driver, enabling full system compromise.

Affected Products

ASUS Fan_Xpert versions prior to v10013
Systems with the ASUS Fan_Xpert kernel driver installed
Windows endpoints shipping the vulnerable DeviceIoControl handler

Discovery Timeline

2024-04-26 - CVE-2024-30804 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in the NVD database

Technical Details for CVE-2024-30804

Vulnerability Analysis

The vulnerability resides in the IOCTL dispatch logic of the ASUS Fan_Xpert driver. Windows drivers expose functionality to user mode through DeviceIoControl calls routed to IRP handlers. When a driver registers a device object accessible to low-privileged users, every IOCTL code it supports becomes an attack surface. CVE-2024-30804 exposes IOCTLs that perform privileged operations without sufficient access control or input validation, classifying the flaw under [CWE-782].

An attacker who can open a handle to the driver device sends crafted IOCTL buffers to reach the vulnerable handler. The driver then performs operations on attacker-controlled data inside kernel context, which leads to arbitrary code execution. A public proof-of-concept exists at the DriverHunter PoC Repository.

Root Cause

The root cause is insufficient validation of IOCTL inputs and missing access control on the exposed device interface. The driver trusts data supplied through DeviceIoControl and dispatches privileged operations to non-administrative callers. This pattern is common in vendor utility drivers that expose direct hardware access through generic read, write, or memory-mapping IOCTLs.

Attack Vector

The attack surface is the device object created by the ASUS Fan_Xpert driver. An attacker opens the device using CreateFile, then issues DeviceIoControl with a crafted IOCTL code and payload. The handler executes the requested operation in kernel mode, enabling arbitrary code execution. Public proof-of-concept code demonstrates the issuance of IOCTL requests against the driver; see the DriverHunter PoC Repository for technical details. No synthetic exploit code is reproduced here.

Detection Methods for CVE-2024-30804

Indicators of Compromise

Presence of the ASUS Fan_Xpert driver binary with a version below v10013 on Windows systems
Unexpected non-administrative processes opening handles to the Fan_Xpert device object
Kernel-mode crashes or bug checks correlated with DeviceIoControl calls to the Fan_Xpert driver

Detection Strategies

Inventory installed kernel drivers and flag any ASUS Fan_Xpert driver below version v10013
Monitor for CreateFile calls targeting the Fan_Xpert device name followed by DeviceIoControl from unsigned or untrusted processes
Alert on driver load events for known-vulnerable hashes using Sysmon Event ID 6 and Windows Event ID 4697

Monitoring Recommendations

Forward Sysmon driver-load, process-create, and file-handle events to a centralized log platform for correlation
Track Windows Defender Application Control (WDAC) or Microsoft Vulnerable Driver Blocklist updates that cover this driver
Watch for privilege escalation chains where a low-integrity process accesses the Fan_Xpert device prior to spawning elevated children

How to Mitigate CVE-2024-30804

Immediate Actions Required

Update ASUS Fan_Xpert to version v10013 or later on all affected systems
Uninstall ASUS Fan_Xpert from endpoints where the utility is not required for hardware management
Enable the Microsoft Vulnerable Driver Blocklist to prevent the vulnerable driver from loading

Patch Information

ASUS addresses the issue in Fan_Xpert v10013 and later. Administrators should obtain the updated build from official ASUS support channels and confirm the on-disk driver version after installation. The DriverHunter PoC Repository documents the original behavior fixed in this release.

Workarounds

Remove the ASUS Fan_Xpert driver where the application is not operationally required
Restrict access to the driver device object using endpoint policy or driver blocklisting until the patched version is deployed
Enforce Hypervisor-Protected Code Integrity (HVCI) and Memory Integrity to limit exploitation of vulnerable kernel drivers

bash

# Verify Fan_Xpert driver version and enable the Microsoft Vulnerable Driver Blocklist
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like '*Fan_Xpert*' } | Select-Object DeviceName, DriverVersion

# Enable Microsoft Vulnerable Driver Blocklist (Windows 11 / Server 2022+)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f