- The Mess: ASUS Control Center Enterprise has a CVSS 10.0 vulnerability chain combining missing authentication, SSRF and hardcoded credentials. An unauthenticated attacker can obtain the encryption key, enable SSH on port 2222 and reach a root shell.
This is not a theoretical “maybe the attacker can read some information” bug.
CVE-2026-75754 describes a complete attack path through ASUS Control Center Enterprise, the centralized management software used to manage systems across an organization.
The vulnerable versions include Control Center Enterprise up to 4.0.0.2.
The first problem is authentication.
A critical function can be reached without proving who the caller is. That opens the door to the next stage: a server-side request forgery condition that can be abused to obtain sensitive information from the application.
Among the information exposed in the attack chain is the encryption key.
And that’s where the situation gets considerably worse.
The attacker can use the obtained key to cause a local service to enable SSH on TCP port 2222.
The final ingredient is already sitting on the system.
Hardcoded credentials.
Once SSH is enabled, those credentials can be used to obtain a root shell.
No stolen employee password is required.
No administrator needs to click anything.
No legitimate account is necessary.
The entire chain starts remotely.
- The Damage: A successful attack can give an intruder root-level control of the ASUS Control Center host and potentially access, modify or delete systems managed through it.
This is what makes CVE-2026-75754 much more serious than an isolated management-console bug.
ASUS Control Center is not merely an application used to view dashboards.
It sits in the management layer.
Compromising that layer can put the machines underneath it at risk.
The CVSS 4.0 score is 10.0 Critical, with network attack access, low attack complexity, no user interaction and no privileges required. The vulnerability also carries high confidentiality, integrity and availability impact both for the vulnerable system and the systems affected downstream.
In practical terms, an attacker who reaches an exposed Control Center installation does not have to work their way through a normal authentication flow.
The vulnerability chain effectively provides the missing bridge.
First obtain the key.
Then manipulate the service.
Then enable SSH.
Then authenticate with credentials that should never have been reusable secrets in the first place.
Then land as root.
That is an unusually clean escalation path for an enterprise management product.
And because the software can manage servers, PCs and workstations across an organization, the blast radius can extend far beyond the original vulnerable machine.
The CVE was published on September 4, 2026 and credits Niels Teusink of Eye Security as the finder.
There is currently no confirmed evidence that CVE-2026-75754 is being actively exploited in the wild. It is also not currently listed in CISA KEV, and public exploit tracking does not show a confirmed working PoC.
That distinction matters.
CVSS 10 does not mean “already exploited.”
It means the technical attack conditions and potential impact are exceptionally severe.
- The Fix: If ASUS Control Center Enterprise is deployed, treat the management server as a high-priority asset, restrict its network exposure immediately and apply the ASUS security update as soon as the vendor provides the applicable fixed release.
Until the affected installation is confirmed safe, do not expose Control Center directly to the Internet.
Put it behind strict network controls.
Allow management access only from trusted administrative networks.
Monitor for unexpected connections to TCP port 2222.
Look for newly enabled SSH services, unexpected authentication attempts and unusual outbound HTTP requests originating from the Control Center host.
Also investigate whether the vulnerable server was reachable from untrusted networks before mitigation.
If it was Internet-facing, don’t assume that “there is no public exploit” means nothing happened.
Review authentication logs.
Review process creation.
Review SSH activity.
Review outbound connections.
And if compromise is suspected, rotate credentials and secrets that could have been accessible from the management host.
The affected version range is particularly important: 4.0.0.2 and earlier are listed as vulnerable.
Do not rely on the fact that the product is used only internally. Internal management systems are exactly the systems an attacker wants after gaining an initial foothold somewhere else.
A centralized management server is a force multiplier.
If you own the server, you own the management plane.
If you own the management plane, the rest of the network may not be far behind.
Bugstoday’s Opinion
This one deserves the 10.0.
Not because the number looks scary.
Because the chain is ugly.
Unauthenticated access.
SSRF.
Encryption-key exposure.
SSH activation.
Hardcoded credentials.
Root.
That is not five unrelated bugs sitting next to each other in a spreadsheet. That’s an attack path.
The really uncomfortable part is what sits behind the root shell: an enterprise management platform with access to an organization’s servers, PCs and workstations.
Attackers don’t need to break every machine individually when the management server can potentially do the work for them.
ASUS has a very unpleasant problem here.
And defenders have an even simpler one:
Find every Control Center instance. Lock it down. Patch it. Then check what happened before you patched it.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
CVE-2026-75754
ASUS Security Advisory
CVE.org / MITRE
NVD
Eye Security — Niels Teusink
CISA Vulnerability Enrichment
