CVE-2026-75754

Critical ASUS Control Center Enterprise Flaw Allows Remote Root Access via CVE-2026-75754

A critical vulnerability identified as CVE-2026-75754 in ASUS Control Center Enterprise (ACC) carries a maximum CVSS score of 10.0 and enables unauthenticated remote attackers to gain full control of the management server and all connected devices. The flaw stems from a combination of missing authentication on a critical function, a server-side request forgery (SSRF) issue, and hardcoded credentials embedded directly in the software. Attackers can craft a malicious HTTP request to extract the system’s encryption key, activate an SSH service on TCP port 2222, and use fixed credentials to obtain a root shell without any user interaction. Once inside, the attacker can read, modify, or delete data stored in the ACC platform and propagate the compromise across managed servers, PCs, and workstations. All versions of ASUS Control Center Enterprise through 4.0.0.2 are affected. ASUS released a security advisory on September 4, 2026, urging immediate updates to mitigate the risk.

Critical Vulnerability in ASUS Control Center Enterprise Allows Remote Root Access Without Authentication

ASUS has disclosed a severe vulnerability in its terminal management software ASUS Control Center Enterprise (ACC) that could allow unauthenticated remote attackers to obtain root privileges. The issue, tracked as CVE-2026-75754, stems from a combination of hardcoded credentials, missing authentication on critical functions, and server-side request forgery flaws. Attackers can retrieve encryption keys via unauthenticated HTTP requests and then enable SSH on TCP port 2222 using the hardcoded credentials to log in as root. The flaw affects managed devices across an organization, potentially leading to data leakage, tampering, deletion, and full remote control. ASUS released a security advisory on September 4, 2026, and strongly recommends immediate updates. The vulnerability was reported by Security NEXT on September 7, 2026.