ASUS has disclosed CVE-2026-75754, a critical vulnerability in ASUS Control Center Enterprise (ACC) that scores a CVSS of 10.0. The flaw affects all builds prior to v3.1.0.9 and could let an unauthenticated attacker seize a root shell across an entire fleet of managed machines.
The advisory describes a chain of three weaknesses: first, a missing authentication check allows an attacker to request the encryption key over HTTP, enabling a local service to turn on SSH on port 2222; next, the attacker can log in using hard-coded credentials to obtain a root shell; finally, a server-side request forgery vulnerability completes the chain, giving full control over the managed devices. The result, if exploited, is highly disruptive and affects confidentiality, integrity and availability.
At present there is no public proof-of-concept exploit and no confirmed real-world exploitation, though the combination of unauthenticated access, hard-coded credentials and SSRF makes the vector highly dangerous. ASUS urges users to update to v3.1.0.9 or later as a matter of urgency and to restrict network access to the ACC management interface, monitoring for unexpected SSH activity on port 2222 in the interim.
The advisory notes the potential for extensive impact in corporate environments because ACC handles servers, PCs and workstations across organisations, meaning a single flaw could compromise an entire fleet.