RomHack 2025 - Leon Jacobs - 7 Vulns in 7 Days: Breaking Bloatware Faster Than It’s Built

Bloatware research origin

Leon Jacobs recounts discovering ASUS DriverHub's local web server after a suspiciously fast reboot during gaming. He targeted ASUS DriverHub, MSI Center, Acer Control Center, and Razer Synapse 4—now patched—using Process Explorer, Binary Ninja, and Burp in VMs with installer anti-VM checks bypassed.

ASUS DriverHub attack path

ADU.exe listens on TCP 5300; the public site's JavaScript calls localhost APIs. Origin-header checks and POST body requirements were reverse-engineered from logs and minified JS, enabling unauthenticated reboot via /reboot with forged origin and JSON command payloads—a string-contains origin-validation flaw.

Broader pattern

Jacobs shows how OEM driver hub bloatware exposes privileged local HTTP APIs to browser-origin policies that are trivially bypassed. The week-long sprint yielded multiple CVEs across vendors, illustrating systemic risk in preinstalled manufacturer utilities that bridge web UIs to system-level actions.