Executive brief
Armoury Crate, ASUS's system management application, has a permissive cross-domain security policy that allows remote attackers to steal local Windows NTLM password hashes. By tricking a user into visiting a malicious webpage, an attacker can force the application to reveal credential hashes that could enable account takeover or offline password cracking attacks.
Technical details
The vulnerability stems from an overly permissive Cross-Origin Resource Sharing (CORS) or similar cross-domain policy in Armoury Crate's local service endpoint. An attacker can craft a web page that, when visited by a user, sends a UNC path request (e.g., \\attacker\share) to the application's local service. This triggers NTLM authentication, causing the user's browser to send the user's NTLM hash to the attacker-controlled server. No authentication or special privileges are required from the victim's perspective—only clicking a link or visiting a page. The attack vector is network-based but requires user interaction (visiting a crafted webpage).
Affected products
- ASUS Armoury Crate
Timeline
- 2026-09-08: disclosed