ASUS Control Center CVE-2026-75754: root via port 2222
A CVSS 10.0 flaw chain in ASUS Control Center Enterprise hands attackers a root shell on your fleet console. No password. Patch and block port 2222.
ASUS published CVE-2026-75754 on September 4. It scores CVSS 4.0 10.0 — the ceiling — against ASUS Control Center Enterprise, the console companies use to manage every ASUS server, workstation, and PC on their network. There is no authentication step to bypass, because there is no authentication step.
What actually happened
The CVE record is unusually plain about the chain. Three weaknesses stack: missing authentication on a critical function (CWE-306), server-side request forgery (CWE-918), and hard-coded credentials (CWE-798). Together, they "allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222."
Read the end of that sentence again. One unauthenticated HTTP request makes the box open an SSH listener on a nonstandard port. The hard-coded credentials then log you in as root.
The vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Network reachable, low complexity, no privileges, no user interaction — and the trailing SC:H/SI:H/SA:H says the scored damage does not stop at the console. It extends to the systems behind it, which is the entire point of a fleet manager.
ASUS lists builds through 4.0.0.2 as affected and directs customers to 3.1.0.9 or later via its security advisory page. That version guidance reads backwards, and we are not going to pretend it doesn't — confirm your target build with ASUS directly rather than assuming the higher number is the safe one. Security outlets covering the disclosure (securityonline.info, Cybersecurity News) report no public proof-of-concept and no confirmed exploitation yet. That gap closes fast on a bug this simple.
Why an unpatched fleet console matters for your business
Management consoles are the highest-leverage target in any small network. They hold privileged agents on every endpoint, they push software, and nobody looks at them between quarterly reboots. Attackers do not need to phish twenty people if one HTTP request gets them root on the machine that owns all twenty.
Three things to do today, in order. Patch to the build ASUS names. Block inbound and outbound traffic on port 2222 at the firewall. Then audit your hosts for SSH listeners you did not put there — if the exploit already ran, the listener is the artifact you can still find.
And answer the harder question underneath: is that console reachable from the public internet at all? Fleet management belongs behind a VPN. Vendor patches close one CVE. Network segmentation closes the class.
Key takeaways
- CVE-2026-75754 is a CVSS 4.0 10.0 unauthenticated root RCE chain in ASUS Control Center Enterprise, published September 4, 2026
- The chain is missing auth + SSRF + hard-coded credentials: one HTTP request leaks the encryption key and opens SSH on port 2222
- ASUS lists versions through 4.0.0.2 as affected and points to 3.1.0.9 or later — confirm the exact build with ASUS, the numbering is confusing
- Interim controls: isolate the ACC interface from public networks, block port 2222 both directions, audit for unexpected SSH listeners
- No public PoC or confirmed in-the-wild exploitation reported as of disclosure
Every management console you run is a door you own. We inventory the tools with privileged access to your machines, get them off the public internet, and build automation whose blast radius you can actually describe. Book a stack audit or see how we work.
Sources: CVE-2026-75754 record, securityonline.info analysis, Cybersecurity News.
- #asus
- #cve
- #endpoint-management
- #rce
- #security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Starlette BadHost: one Host header bypasses your auth
CVE-2026-48710 lets a malformed Host header poison request.url.path and skip path-based middleware. CISA KEV, due September 16. Upgrade Starlette to 1.0.1.
Read itSwitchvox CVE-2026-9586: your phone system runs code
Unauthenticated SQL injection in Sangoma Switchvox's /pa endpoint gives RCE. Patched July 14, exploited August 30, ~4,000 boxes exposed. Upgrade to 8.4.0.2.
Read it