CVE-2023-5716 is a critical (CVSS 9.8) arbitrary file write flaw in ASUS Armoury Crate, caused by a missing authentication check. Remote attackers can read or modify files by sending specific HTTP requests. TWCERT lists V4.0.1.3 as affected and says to update to V4.1.0.8.
What's affected
- Product: ASUS Armoury Crate.
- Affected: V4.0.1.3, per the TWCERT/CC Taiwan Vulnerability Note TVN-202401002.
- Fixed: V4.1.0.8, per the same note.
- Severity: 9.8 Critical in both the NVD record and TWCERT (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Other versions: the note names only V4.0.1.3. If you run something else, check ASUS for its status.
How to check if you're exposed
Open the Armoury Crate app and read the version in its settings or About page, or look at the installed program list in Windows Settings under Apps. Anything at V4.0.1.3 is named as affected. Any version below V4.1.0.8 should be treated as unconfirmed until you check with ASUS.
If you manage many machines, query the installed software list from your endpoint tool and filter for Armoury Crate.
What to do now
- Update Armoury Crate to V4.1.0.8 or later, from the ASUS website or the app's own update function.
- Confirm the version after the update and note it in your asset records.
- On machines you cannot update right away, block inbound connections to the app's local service at the host firewall.
- If the app is not needed, uninstall it. Fewer background services means less attack surface.
- Look for unexpected new or changed files in system and program folders on machines that were exposed.
Why it matters
The record classes the flaw as CWE-306, missing authentication for a critical function. A service that accepts HTTP requests and performs file writes, with no check on who is asking, hands that capability to anyone who can reach it. A file write is a short step from code execution, because the written file can replace something the system later runs.
A 9.8 score reflects network reach, no required privileges and no user interaction. The score alone does not tell you how reachable the service is on a given machine, which depends on how the app binds its listener and what the host firewall allows. TWCERT does not describe exploitation. The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog. Update first, then confirm reachability.
Quick check
Is the fixed version confirmed?
Yes by TWCERT/CC, which names V4.1.0.8 as the update. The NVD record itself gives only a short description, so keep the TWCERT note as your reference.
Sources
Last reviewed: 19 October 2026.
