LiveActive security incident?Get immediate response
CVE Record

CVE-2019-19235: AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windows 10 notebook PCs) could lead to unsigned code...

AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windows 10 notebook PCs) could lead to unsigned code execution with no additional execution. The user must put an application at a particular path, with a particular file name.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This issue affects ASUS ATK Package before V1.0.0061 on Windows 10 notebook PCs. A local user could cause ASUS loader service behavior to run unsigned code if an application is placed with a required name in a required location. The public record does not show active exploitation.

Executive priority

Prioritize normal endpoint remediation rather than emergency response unless internal telemetry shows suspicious staging. The issue enables code execution only under specific local preconditions, but outdated vendor utilities can become useful post-compromise persistence or privilege-abuse targets.

Technical view

CVE-2019-19235 describes unsigned code execution involving AsLdrSrv.exe in ASUS ATK Package before V1.0.0061. The record indicates a path-and-filename precondition, but does not provide CVSS, CWE, detailed affected CPEs, or exploit confirmation. Treat it as a local endpoint hardening and software version control issue.

Likely exposure

Exposure is most likely on ASUS Windows 10 notebook PCs running ATK Package versions earlier than V1.0.0061. The bundle’s affected-product metadata is incomplete, so confirm exact models and package applicability through ASUS guidance.

Exploitation context

The source bundle does not indicate KEV listing or active exploitation. The described prerequisite is local placement of an application at a specific path and name, which limits remote exploitability but may matter after initial endpoint access.

Researcher notes

Public evidence is thin: no CVSS, CWE, CPE list, or detailed advisory text is included in the bundle. Do not assume broader ASUS software impact beyond ATK Package before V1.0.0061 on Windows 10 notebooks without vendor confirmation.

Mitigation direction

  • Upgrade ASUS ATK Package to V1.0.0061 or later where applicable.
  • Check ASUS support and security advisory pages for model-specific guidance.
  • Inventory ASUS Windows 10 notebooks for installed ATK Package versions.
  • Remove unsupported or unnecessary ATK Package installations.
  • Use endpoint controls to restrict unauthorized file placement in vendor application locations.

Validation and detection

  • Confirm whether ASUS Windows 10 notebooks are present in the fleet.
  • Check installed ATK Package version on each applicable endpoint.
  • Verify remediation by confirming version V1.0.0061 or later.
  • Review endpoint telemetry for unauthorized binaries in vendor load locations.
  • Document exceptions where ASUS guidance shows the package is not applicable.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-19235 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.