CVE-2025-11901 - Vulnerability Details - OpenCVE

An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA). Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

References

Link	Providers
https://www.asus.com/security-advisory/

History

Wed, 17 Dec 2025 04:45:00 +0000

Type	Values Removed	Values Added
Description		An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA). Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.
Weaknesses		CWE-284
References		https://www.asus.com/security-advisory/
Metrics		cvssV4_0 `{'score': 7, 'vector': 'CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: ASUS

Published: 2025-12-17T04:23:51.784Z

Updated: 2025-12-17T04:23:51.784Z

Reserved: 2025-10-17T06:47:40.071Z

Link: CVE-2025-11901

Vulnrichment

No data.

NVD

Status : Received

Published: 2025-12-17T05:16:10.793

Modified: 2025-12-17T05:16:10.793

Link: CVE-2025-11901

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11901", "assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "state": "PUBLISHED", "assignerShortName": "ASUS", "dateReserved": "2025-10-17T06:47:40.071Z", "datePublished": "2025-12-17T04:23:51.784Z", "dateUpdated": "2025-12-17T04:23:51.784Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "B460 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1805, 2002, 3002"}]}, {"defaultStatus": "unaffected", "product": "B560 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2402, 2803"}]}, {"defaultStatus": "unaffected", "product": "B660 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3810, 4501"}]}, {"defaultStatus": "unaffected", "product": "B760 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1825, 3102"}]}, {"defaultStatus": "unaffected", "product": "H410 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1805, 2002"}]}, {"defaultStatus": "unaffected", "product": "H470 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3002"}]}, {"defaultStatus": "unaffected", "product": "H510 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2402, 2803"}]}, {"defaultStatus": "unaffected", "product": "H610 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3810"}]}, {"defaultStatus": "unaffected", "product": "W480 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1002, 2603, 3302"}]}, {"defaultStatus": "unaffected", "product": "W680 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2015, 2701, 4501"}]}, {"defaultStatus": "unaffected", "product": "Z590 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 2402, 2803"}]}, {"defaultStatus": "unaffected", "product": "Z690 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 3810, 4501"}]}, {"defaultStatus": "unaffected", "product": "Z790 series", "vendor": "ASUS", "versions": [{"status": "affected", "version": "before 1825, 2102, 3102"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Mohamed Al-Sharifi & Nick Peterson"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using<span style=\"background-color: rgb(255, 255, 255);\"> Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets</span><span style=\"background-color: rgb(255, 255, 255);\">. </span>Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).<br>Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.\n\n<br>"}], "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\u00a0Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\nRefer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "baseScore": 7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "shortName": "ASUS", "dateUpdated": "2025-12-17T04:23:51.784Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.asus.com/security-advisory/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using\u00a0Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\nRefer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information."}], "id": "CVE-2025-11901", "lastModified": "2025-12-17T05:16:10.793", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}]}, "published": "2025-12-17T05:16:10.793", "references": [{"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "url": "https://www.asus.com/security-advisory/"}], "sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary"}]}