ASUS DriverHub flaw let malicious sites run commands with admin rights

The ASUS DriverHub driver management utility was vulnerable to a critical remote code execution flaw that allowed malicious sites to execute commands on devices with the software installed. The flaw was discovered by an independent cybersecurity researcher from New Zealand named Paul (aka "MrBruh"), who found that the software had poor validation of commands sent to the DriverHub background service. This allowed the researcher to create an exploit chain utilizing flaws tracked as CVE-2025-3462 and CVE-2025-3463 that, when combined, achieve origin bypass and trigger remote code execution on the target. DriverHub is ASUS's official driver management tool that is automatically installed on the first system boot when utilizing certain ASUS motherboards. This software runs in the background, automatically detecting and fetching the latest driver versions for the detected motherboard model and its chipset. Once installed, the tool remains active and running in the background via a local service on port 53000, continually checking for important driver updates. Meanwhile, most users don't even know such a service is constantly running on their system. That service checks the Origin Header of incoming HTTP requests to reject anything that doesn't come from 'driverhub.asus.com.' However, this check is poorly implemented, as any site that includes that string is accepted even if it's not an exact match to ASUS's official portal. The second issue lies in the UpdateApp endpoint, which al...