CVE-2025-59374criticalunder attackCWE-506

CVE-2025-59374: critical vulnerability in ASUS live update

Published · Updated

Follow this CVE+ Monitor live

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.3epss 1.2%
from disclosure to weapon
Published on NVDDec 17
CISA KEVDec 17
Action required by CISAfederal deadline: 2026-01-07

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Versions of the ASUS Live Update client were tampered with during production, allowing attackers to make affected devices perform unwanted actions if specific conditions were met. Only older, unsupported devices that installed these compromised versions were at risk.

Technical detail

Supply chain compromise affecting ASUS Live Update client where unauthorized modifications were injected into distributed builds. Attack requires device to match specific targeting conditions and have installed the compromised version; impact includes arbitrary unintended device actions. Product reached EOS in October 2021; no currently supported versions or devices are affected.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
ASUS · live update