CVE-2025-9968: Armoury Crate Privilege Escalation Flaw

CVE-2025-9968 Overview

CVE-2025-9968 is a link following vulnerability in the UnifyScanner component of ASUS Armoury Crate. An attacker with local, low-privileged access can create a specially crafted NTFS junction to redirect file operations performed by the privileged scanner process. Successful exploitation results in local privilege escalation on the affected Windows host.

The flaw is tracked under CWE-59: Improper Link Resolution Before File Access. ASUS documents remediation guidance in its ASUS Security Advisory under the section "Security Update for Armoury Crate App".

Critical Impact
A local, authenticated attacker can abuse filesystem junctions handled by UnifyScanner to escalate privileges to SYSTEM on Windows endpoints running vulnerable Armoury Crate versions.

Affected Products

ASUS Armoury Crate App (Windows)
Armoury Crate UnifyScanner component
Systems running vulnerable Armoury Crate versions listed in the ASUS advisory

Discovery Timeline

2025-10-13 - CVE-2025-9968 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9968

Vulnerability Analysis

Armoury Crate ships a privileged scanner component named UnifyScanner that performs file system operations on behalf of a service running with elevated privileges. The component resolves file paths without adequately validating whether those paths cross a reparse point such as an NTFS junction or symbolic link. This is a classic link following weakness catalogued as [CWE-59].

When the scanner accesses a file inside an attacker-controlled directory, Windows transparently follows the junction to a target chosen by the attacker. The privileged process then reads, writes, deletes, or overwrites files at that target location using its own SYSTEM-level access token. The result is a local privilege escalation primitive with high impact to confidentiality, integrity, and availability.

Root Cause

The root cause is missing reparse point validation before file access in UnifyScanner. The component trusts path resolution performed by the Windows I/O manager rather than verifying that each path element resides within an expected, non-user-writable directory. Any low-privileged user who can write to a directory the scanner traverses can plant a junction pointing to sensitive locations such as C:\Windows\System32 or protected service directories.

Attack Vector

The attack requires local access and low privileges. No user interaction is needed once the malicious junction is staged. An attacker performs the following high-level steps:

Identifies a directory scanned by the privileged UnifyScanner process that the attacker can write to.
Creates an NTFS junction inside that directory pointing to a protected target path.
Waits for or triggers a scan cycle so the privileged process follows the junction and operates on the attacker-chosen target.

Because UnifyScanner executes with elevated privileges, the resulting file write, overwrite, or deletion enables arbitrary code execution as SYSTEM. Technical specifics on affected versions and fixed builds are provided in the ASUS Security Advisory.

Detection Methods for CVE-2025-9968

Indicators of Compromise

Creation of NTFS junctions or reparse points inside directories accessed by UnifyScanner or other Armoury Crate service directories.
Unexpected file writes, overwrites, or deletions in C:\Windows\System32 or other protected paths performed by Armoury Crate service processes.
New or modified executables, DLLs, or scheduled tasks appearing shortly after Armoury Crate scan activity.

Detection Strategies

Monitor for mklink /J invocations and calls to CreateSymbolicLink or DeviceIoControl with FSCTL_SET_REPARSE_POINT by non-administrative users.
Alert on Armoury Crate service processes writing to paths outside their expected working directories.
Correlate reparse point creation events in user-writable directories with subsequent privileged file operations by Armoury Crate processes.

Monitoring Recommendations

Enable Windows Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime) on hosts running Armoury Crate to capture junction manipulation.
Ingest endpoint telemetry into a SIEM or data lake to baseline normal Armoury Crate scan behavior and flag deviations.
Track process lineage where a low-privileged user process precedes privileged file modifications by UnifyScanner.

How to Mitigate CVE-2025-9968

Immediate Actions Required

Update Armoury Crate to the fixed version listed in the ASUS Security Advisory as soon as it is available for your platform.
Inventory endpoints running Armoury Crate, particularly developer, gaming, and enthusiast workstations that may not follow standard patch cycles.
Restrict local logon on affected systems to trusted users until patches are applied.

Patch Information

ASUS publishes fixed versions and remediation guidance under the section "Security Update for Armoury Crate App" in the ASUS Security Advisory. Administrators should apply the vendor update through the Armoury Crate updater or by downloading the fixed installer from the official ASUS support portal.

Workarounds

Uninstall Armoury Crate on systems where it is not required for hardware management until a patched version is deployed.
Disable or stop the Armoury Crate service so UnifyScanner does not run with elevated privileges on vulnerable hosts.
Remove write permissions for standard users on any directories the scanner traverses to prevent junction planting.