CVE-2025-12793
Published: 06 January 2026
Summary
CVE-2025-12793 is a high-severity Untrusted Search Path (CWE-426) vulnerability in Asus Myasus. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique DLL (T1574.001); ranked at the 1.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2025-12793 is an uncontrolled DLL loading path vulnerability (CWE-426) in AsusSoftwareManagerAgent, a component associated with ASUS software such as MyASUS. Published on 2026-01-06, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw allows the application to load a dynamic link library from an unintended, attacker-specified path.
A local attacker can exploit this vulnerability by influencing AsusSoftwareManagerAgent to load a malicious DLL from a location under their control, potentially resulting in arbitrary code execution with the privileges of the affected process. Exploitation requires local access to the system, low complexity, no special privileges, and user interaction, such as convincing a user to trigger the vulnerable functionality.
The ASUS Security Advisory, available at https://www.asus.com/security-advisory, addresses mitigation in the "Security Update for MyASUS" section, recommending users apply the provided updates to resolve the uncontrolled DLL loading issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1095
Vulnerability details
An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacker-controlled location, potentially resulting in arbitrary code execution. Refer to the ' Security Update for MyASUS' section on…
more
the ASUS Security Advisory for more information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Uncontrolled DLL load path (CWE-426) directly enables attacker-supplied DLL to be loaded by the process, matching DLL Side-Loading.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing this CVE by mandating application of the ASUS security update for MyASUS that fixes the uncontrolled DLL loading path in AsusSoftwareManagerAgent.
CM-6 enforces secure configuration settings, such as enabling Safe DLL Search Mode in Windows, which mitigates uncontrolled DLL loading by prioritizing system directories over attacker-controlled paths.
SI-7 provides software integrity verification to detect unauthorized or malicious DLLs loaded by AsusSoftwareManagerAgent, preventing execution of attacker-placed code from uncontrolled paths.