Medium severity · published Jul 21, 2025
CVE-2025-4570
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services
6.9
CVSS
0.4%
EPSS
No
On KEV
Description
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services.
Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MY
MyASUS · ASUS
4.0.35.0 and earlier · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4570
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4570
www.asus.com
https://www.asus.com/content/security-advisory/
More from MyASUS
9.8
CVE-2022-22814
The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation
8.5
CVE-2025-59373
A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface
7.8
CVE-2025-12793
An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent
7.7
CVE-2025-4569
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services