CVE-2025-11901

State: Published
Severity: 7.0 High
Published: Dec 17, 2025
Updated: Dec 17, 2025
Reserved: Oct 17, 2025

Description

An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA). Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	ASUS

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
B460 seriesASUS	before 1805, 2002, 3002Affected
B560 seriesASUS	before 2402, 2803Affected
B660 seriesASUS	before 3810, 4501Affected
B760 seriesASUS	before 1825, 3102Affected
H410 seriesASUS	before 1805, 2002Affected
H470 seriesASUS	before 3002Affected
H510 seriesASUS	before 2402, 2803Affected
H610 seriesASUS	before 3810Affected
W480 seriesASUS	before 1002, 2603, 3302Affected
W680 seriesASUS	before 2015, 2701, 4501Affected
Z590 seriesASUS	before 2402, 2803Affected
Z690 seriesASUS	before 3810, 4501Affected
Z790 seriesASUS	before 1825, 2102, 3102Affected

References

https://www.asus.com/security-advisory/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.