dbcve.org
Improper Access ControlWeakness · CWE-284

CVE-2025-11901

HIGH · 7.0 CVSS v4.0 Published 2025-12-17
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
75/100
Remediation priority · High
No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel B460, B560, B660, B760, H410, H510, H610, H470, Z590, Z690, Z790, W480, W680 series chipsets. Exploitation requires physical access to internal expansion slots to install a specially crafted device and supporting software utility, and may lead to uncontrolled resource consumption that increases the risk of unauthorized direct memory access (DMA). Refer to the 'Security Update for UEFI firmware' section on the ASUS Security Advisory for more information.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

This is a UEFI firmware vulnerability in ASUS motherboards with Intel chipsets (B460 through Z790 series and W480/W680). An attacker with physical access can install a specially crafted device into internal expansion slots (likely PCIe) along with supporting software, causing uncontrolled resource consumption that may enable unauthorized direct memory access (DMA). The vulnerability stems from insufficient controls on resource allocation for devices in internal expansion slots.

MitigationApply the ASUS UEFI firmware security update from the ASUS Security Advisory. Organizations should review their physical security controls given the requirement for physical access to internal expansion slots.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Physical
Complexity
Low
Privileges
None
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify your ASUS motherboard model and chipset
    Run 'dmidecode -s baseboard-product-name' or visually inspect the motherboard markings. Check the chipset by reviewing specifications on the ASUS product page or running 'lspci | grep -i host bridge' to identify the Intel chipset.
    Affected if The motherboard is an ASUS model with an Intel B460, B560, B660, B760, B860, H410, H510, H610, H660, H760, Q470, Q570, Q670, R6400, R6800, W480, W680, Z490, Z590, Z690, Z790, or Z890 chipset.
  2. Determine your current UEFI firmware version
    Run 'dmidecode -s bios-version' or enter the UEFI setup during boot (typically pressing Delete or F2) and check the BIOS version displayed on the main screen. Note this version for comparison.
    Affected if The UEFI firmware version has not been updated to the patched version released by ASUS for this specific CVE.
  3. Verify physical security of the system chassis
    Assess whether the system is located in a secured area (locked room, cage, or cabinet). Determine if the chassis has lockable covers or tamper-evident seals. Check who has authorized physical access to the machine.
    Affected if Unauthorized individuals can gain physical access to the internal components of the system.
  4. Audit internal expansion slots for unexpected devices
    Power off the system, open the chassis, and visually inspect all PCIe and other internal expansion slots for unknown devices. Alternatively, run 'lspci -v' or 'lshw -class bridge' to list all detected PCI devices.
    Affected if Any unexpected or unauthorized device is installed in an internal expansion slot.
  5. Check DMA protection settings in UEFI
    Enter UEFI setup during boot and navigate to Advanced or Security settings. Look for options labeled IOMMU, VT-d, DMA Protection, or Memory Protection. Verify whether these settings are enabled.
    Affected if IOMMU or DMA protection features are disabled in the UEFI configuration.

You are affected if you run an ASUS motherboard with an Intel B460 through Z790 or W480/W680 chipset, have not applied the ASUS security patch for this UEFI vulnerability, and your system is physically accessible to untrusted individuals who could install devices into internal expansion slots.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply the ASUS UEFI firmware security update from the ASUS Security Advisory. Organizations should review their physical security controls given the requirement for physical access to internal expansion slots.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation3.0 h
  • Testing2.0 h
  • Review / QA1.0 h
8.0 hours of engineering $1,420
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,272.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-11901 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-11901 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data