CVE-2025-15037: ASUS Business System Privilege Escalation

CVE-2025-15037 Overview

CVE-2025-15037 is an incorrect permission assignment vulnerability [CWE-732] in the ASUS Business System Control Interface driver. The driver exposes sensitive functionality through an Input/Output Control (IOCTL) interface that does not properly restrict access based on caller privileges. An unprivileged local user can send a specially crafted IOCTL request to reach kernel-mode code paths that should be limited to administrators. Successful exploitation can grant unauthorized access to sensitive hardware resources and disclose kernel information that aids further attacks. ASUS describes the issue under the "ASUS Business System Control Interface" section of its security advisory.

Critical Impact

Local unprivileged users can issue IOCTL requests to the ASUS Business System Control Interface driver and read kernel memory or access privileged hardware resources, weakening kernel address space layout randomization (KASLR) protections and enabling follow-on privilege escalation.

Affected Products

• ASUS Business System Control Interface driver (Windows kernel driver shipped with ASUS commercial systems)
• Refer to the ASUS Security Advisory for the full list of impacted models and driver versions

Discovery Timeline

• 2026-03-12 - CVE-2025-15037 published to the National Vulnerability Database (NVD)
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-15037

Vulnerability Analysis

The ASUS Business System Control Interface driver registers a device object that accepts IOCTL requests from user mode. The driver does not enforce sufficient access checks on the device object's Discretionary Access Control List (DACL) or within individual IOCTL handlers. As a result, any local user with the ability to open the device can dispatch IOCTLs that the vendor intended only for privileged management software.

The affected IOCTL handlers expose primitives that interact with hardware and kernel memory. According to the CVSS vector, exploitation requires local access and low privileges, with high impact on confidentiality and no direct impact on integrity or availability. This profile aligns with a kernel information disclosure and hardware access exposure rather than direct code execution.

Root Cause

The root cause is improper permission assignment on a privileged kernel interface [CWE-732]. The driver fails to validate that callers hold administrative rights before granting access to sensitive operations. Combined with a permissive device DACL, this design lets standard user tokens reach kernel-resident functionality that was assumed to be administrator-only.

Attack Vector

An attacker first obtains code execution as any local user on a system where the vulnerable driver is loaded. The attacker opens a handle to the driver's device object and issues DeviceIoControl calls with crafted IOCTL codes and input buffers. The driver processes these requests in kernel mode and returns data sourced from physical memory, model-specific registers, or other hardware-backed resources. The attacker uses the returned data to defeat KASLR or to pivot to a separate kernel exploit. No verified proof-of-concept code is published in the referenced advisory, so the vulnerability is described here in prose only. See the ASUS Security Advisory for vendor technical details.

Detection Methods for CVE-2025-15037

Indicators of Compromise

• Unexpected processes running as standard users that open handles to the ASUS Business System Control Interface device object
• DeviceIoControl activity against the ASUS driver originating from non-ASUS or non-administrative binaries
• Kernel driver load events for outdated versions of the ASUS Business System Control Interface driver on systems where ASUS management software is not actively used

Detection Strategies

• Inventory endpoints for the presence and version of the ASUS Business System Control Interface driver and compare against the fixed version listed in the ASUS advisory
• Audit handle-open and IOCTL telemetry to the ASUS device object from unsigned or non-vendor user-mode processes
• Correlate driver interactions with subsequent suspicious activity such as token manipulation, credential access, or new service creation

Monitoring Recommendations

• Enable Windows kernel auditing and Endpoint Detection and Response (EDR) telemetry for driver load events and IOCTL traffic
• Alert on standard user accounts opening handles to vendor management drivers that are typically used only by administrative tooling
• Track local privilege escalation patterns following ASUS driver access, including process token changes and kernel exploit signatures

How to Mitigate CVE-2025-15037

Immediate Actions Required

• Apply the updated ASUS Business System Control Interface driver published in the ASUS Security Advisory to all affected endpoints
• Remove the driver on systems that do not require ASUS management functionality
• Restrict local logon and code execution rights to reduce the population of users who could reach the IOCTL interface

Patch Information

ASUS has published remediation guidance under the "ASUS Business System Control Interface" section of its security portal. Administrators should consult the ASUS Security Advisory for the fixed driver version and deploy it through standard software distribution channels. Verify the updated driver is loaded by checking the driver version in Device Manager or with pnputil /enum-drivers after deployment.

Workarounds

• Block load of the vulnerable driver version using Windows Defender Application Control (WDAC) or a driver blocklist policy until patching completes
• Tighten the DACL on the driver's device object where supported, or uninstall the ASUS Business System Control Interface package on systems that do not need it
• Limit standard user privileges and enforce application allowlisting to reduce the chance of an attacker reaching DeviceIoControl against the vulnerable device

# Configuration example: list loaded ASUS drivers and confirm the patched version
pnputil /enum-drivers | findstr /I "asus"
sc query type= driver | findstr /I "AsusBusinessSystemControl"