CVE-2026-12962: Medium severity ASUS Armoury Crate vulnerability
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must convince a local user to visit a crafted web page. That page sends a request containing a UNC path to Armoury Crate's local service endpoint, which can cause the user's NTLM hash to be exposed.
Who is exposed to this attack?
Users with ASUS Armoury Crate installed are exposed when they visit an attacker-controlled crafted web page. The issue involves the application's local service endpoint and does not require the attacker to have local access first.
What is the impact if exploitation succeeds?
A remote attacker can obtain the local user's NTLM hash. The provided information does not state whether the hash can be relayed, cracked, or used for further access.