CVE-2025-11901
Estado: AplazadaAlta (7)—
An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA). Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 7
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.23%
- Percentil entre todas las CVEs puntuadas: 12
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1091Replication Through Removable Medialateral movement · initial access95 % - Impacto principal
T1499.004Application or System Exploitationimpact85 % - Impacto secundario
T1578Modify Cloud Compute Infrastructuredefense impairment70 %
Acceso físico a slots internos (AV:P) requiere medios extraíbles/hardware físico (T1091). Consumo descontrolado de recursos y DMA sugieren DoS y acceso a memoria (T1499.004, T1578).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (14)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Asus — Asus MotherboardsAIIntel — B460 ChipsetAIIntel — B560 ChipsetAIIntel — B660 ChipsetAIIntel — B760 ChipsetAIIntel — H410 ChipsetAIIntel — H470 ChipsetAIIntel — H510 ChipsetAIIntel — H610 ChipsetAIIntel — W480 ChipsetAIIntel — W680 ChipsetAIIntel — Z590 ChipsetAIIntel — Z690 ChipsetAIIntel — Z790 ChipsetAI
CWE
- CWE-284
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-11901",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-11901",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-12-17T21:46:16.833758Z"
}
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 7,
"Automatable": "NOT_DEFINED",
"attackVector": "PHYSICAL",
"baseSeverity": "HIGH",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
"affectedData": [
{
"vendor": "ASUS",
"product": "B460 series",
"versions": [
{
"status": "affected",
"version": "before 1805, 2002, 3002"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "B560 series",
"versions": [
{
"status": "affected",
"version": "before 2402, 2803"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "B660 series",
"versions": [
{
"status": "affected",
"version": "before 3810, 4501"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "B760 series",
"versions": [
{
"status": "affected",
"version": "before 1825, 3102"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "H410 series",
"versions": [
{
"status": "affected",
"version": "before 1805, 2002"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "H470 series",
"versions": [
{
"status": "affected",
"version": "before 3002"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "H510 series",
"versions": [
{
"status": "affected",
"version": "before 2402, 2803"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "H610 series",
"versions": [
{
"status": "affected",
"version": "before 3810"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "W480 series",
"versions": [
{
"status": "affected",
"version": "before 1002, 2603, 3302"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "W680 series",
"versions": [
{
"status": "affected",
"version": "before 2015, 2701, 4501"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "Z590 series",
"versions": [
{
"status": "affected",
"version": "before 2402, 2803"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "Z690 series",
"versions": [
{
"status": "affected",
"version": "before 3810, 4501"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "ASUS",
"product": "Z790 series",
"versions": [
{
"status": "affected",
"version": "before 1825, 2102, 3102"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2025-12-17T05:16:10.793",
"references": [
{
"url": "https://www.asus.com/security-advisory/",
"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA).\nRefer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information."
},
{
"lang": "es",
"value": "Una vulnerabilidad de consumo de recursos no controlado afecta a ciertas placas base ASUS que utilizan chipsets de la serie Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680. La explotación requiere acceso físico a las ranuras de expansión internas para instalar un dispositivo especialmente diseñado y una utilidad de software de soporte, y puede conducir a un consumo de recursos no controlado que aumenta el riesgo de acceso directo a memoria (DMA) no autorizado.\nConsulte la sección 'Actualización de seguridad para firmware UEFI' en el Aviso de Seguridad de ASUS para obtener más información."
}
],
"lastModified": "2026-09-30T20:10:00.247",
"sourceIdentifier": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1"
}