ASUS has issued an urgent advisory regarding a critical vulnerability in its terminal management software ASUS Control Center Enterprise (ACC). The flaw, identified as CVE-2026-75754, enables remote attackers to gain root-level access without any authentication.
The vulnerability arises from multiple interconnected issues, including hardcoded credentials, absence of authentication for key functions, and server-side request forgery (SSRF). These weaknesses allow an attacker to retrieve encryption keys through simple HTTP requests and subsequently activate SSH on TCP port 2222 using the embedded credentials to obtain root access.
Successful exploitation could result in the leakage, alteration, or deletion of data stored on affected devices. In enterprise environments, attackers may also achieve remote control over all managed endpoints within the organization.
ASUS published the security advisory on September 4, 2026, and strongly recommends that all users apply the available updates without delay. No workarounds have been provided, making patching the only effective mitigation.
