CVE-2020-10649

DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name.

• CWE-427

• https://drive.google.com/file/d/1Ap293b7bZLen6DmheppR1IUFEAsCSORC/view?usp=sharingExploit, Mailing List, Third Party Advisory
• https://www.asus.com/Laptops/ASUS-TUF-Gaming-FX504/HelpDesk_Download/Vendor Advisory
• https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/Vendor Advisory
• https://www.asus.com/support/FAQ/1042640/Vendor Advisory
• https://drive.google.com/file/d/1Ap293b7bZLen6DmheppR1IUFEAsCSORC/view?usp=sharingExploit, Mailing List, Third Party Advisory
• https://www.asus.com/Laptops/ASUS-TUF-Gaming-FX504/HelpDesk_Download/Vendor Advisory
• https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/Vendor Advisory
• https://www.asus.com/support/FAQ/1042640/Vendor Advisory

Published

Mar 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10642In Rockwell Automation RSLinx Classic versions 4.11.00 and p…7.8
• CVE-2020-10643An authenticated remote attacker could use specially crafted…5.4
• CVE-2020-10644The affected product lacks proper validation of user-supplie…7.5
• CVE-2020-10646Fuji Electric V-Server Lite all versions prior to 4.0.9.0 co…7.8
• CVE-2020-10647Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-10648Das U-Boot through 2020.01 allows attackers to bypass verifi…7.8
• CVE-2020-1065A remote code execution vulnerability exists in the way that…7.5
• CVE-2020-10650A deserialization flaw was discovered in jackson-databind th…8.1
• CVE-2020-10654Ping Identity PingID SSH before 4.0.14 contains a heap buffe…9.8
• CVE-2020-10655The Proofpoint Insider Threat Management Server (formerly Ob…9.8
• CVE-2020-10656The Proofpoint Insider Threat Management Server (formerly Ob…9.8
• CVE-2020-10657The Proofpoint Insider Threat Management Server (formerly Ob…7.2