ASUS Live Update
CVE-2025-59374
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise ASUS Live Update supply chain
-
DeliveryInject malicious code into signed update builds
-
ExploitDistribute trojanized update to devices
-
ExecutionMatch victim targeting conditions
-
PersistExecute payload with client privileges
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Code review, malicious code detection
|
| Exploitation Conditions | Exploitation requires that a device (1) installed one of the specific compromised builds of the ASUS Live Update client, and (2) met the attacker-defined targeting conditions embedded in the malicious code; only devices satisfying both were affected. The malicious code was delivered through ASUS's trusted update distribution channel, so no victim authentication or interaction was needed on the target device (PR:N/UI:N), but the campaign was selective rather than universal. Key LIMITING factors: the client reached End-of-Support in October 2021 and ASUS states no currently supported products are affected, meaning realistic present-day exposure is confined to unsupported legacy devices still running compromised Live Update builds. |
| Impact | This is a genuine top-priority issue, not a high-CVSS paper tiger. Multiple independent signals converge: CISA KEV lists it as confirmed actively exploited, CWE-506 (embedded malicious code) plus the description confirm a supply-chain trojan in signed/distributed ASUS Live Update builds, and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) reflects full compromise of affected devices with no privileges or interaction. The one comparatively soft signal is EPSS at 1.20% (67th percentile), which is only moderate - but EPSS models generic remote-exploit probability and systematically undercounts supply-chain / already-delivered-payload attacks, so the low EPSS should NOT downgrade priority given the KEV confirmation. Two important qualifiers temper real-world exposure today: (1) the product reached End-of-Support in October 2021 and ASUS states no currently supported products are affected, and (2) only devices meeting 'specific targeting conditions' that also installed the compromised builds were actually impacted, indicating a targeted rather than indiscriminate campaign. No standalone POC is referenced, and exploitation is historical/delivery-based rather than something a defender re-triggers, so the actionable response is detection/removal of compromised Live Update builds rather than patching a live network service. |
| Exploit ScenarioDerived | An attacker with access to the ASUS Live Update distribution/build pipeline injects malicious code into otherwise legitimate update packages, which are then pushed to end-user devices through the trusted update channel. Devices matching the attacker's targeting criteria silently execute the implanted payload with the update client's privileges, giving the attacker code execution on selected victims without any user interaction. CISA KEV confirms this was exploited in the wild; no separate public POC is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Compromised builds of the ASUS Live Update client, distributed through ASUS's own trusted update channel, could cause devices to perform unintended actions, constituting a supply-chain compromise that is now confirmed actively exploited (CISA KEV). Only devices that installed one of the specific modified builds and also met the attacker's embedded targeting conditions were affected, so the campaign was selective rather than universal; no victim authentication or interaction was needed on an affected target (PR:N/UI:N per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Realistic present-day exposure is confined to unsupported legacy devices, because the Live Update client reached End-of-Support in October 2021 and ASUS states no currently supported products are affected; EPSS is 1.20% (67th percentile).
RemediationAI
No vendor-released patch is identified in the available data for the End-of-Support ASUS Live Update client, and ASUS's position is that no currently supported products are affected, so remediation is primarily about eliminating legacy exposure. On any unsupported device still carrying a potentially compromised Live Update build, uninstall or fully remove the ASUS Live Update client and stop/disable the associated update service and scheduled task so no further vendor-update code can execute (side effect: the device loses automated ASUS software and firmware updates and must be updated manually). Where removal is not immediately possible, block outbound access from those hosts to ASUS Live Update distribution and telemetry endpoints at the network egress or DNS layer to sever the trusted update channel (side effect: legitimate updates and licensing/telemetry checks will also fail, and a determined implant could attempt alternate egress paths). Because the compromise was selective, absence of symptoms is not evidence of absence of an implant, so plan for host rebuilds of affected legacy machines and prioritize decommissioning hardware that is past the October 2021 End-of-Support date. Track the vendor advisory at https://www.asus.com/news/hqfgvuyz6uyayje1/ and the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59374, and apply CISA's KEV-mandated remediation timelines where the catalog applies to your environment.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is an instance of CWE-506 (Embedded Malicious Code): unauthorized modifications were introduced into certain ASUS Live Update client builds during distribution, meaning the malicious logic entered endpoints through a trusted, signed vendor update path rather than through an exploited remote vulnerability in the client itself. The affected component is the ASUS Live Update client, identified in the CPE data as cpe:2.3:a:asus:live_update:*:*:*:*:*:*:*:* (all-version wildcard, consistent with ASUS not enumerating the specific compromised builds publicly). Because the code arrived via the update channel and executed with the client's privileges, the assessed vector is network-reachable with no privileges or user interaction required (PR:N/UI:N), and the attacker-embedded targeting conditions determined which devices actually triggered the unintended actions; the description's explicit scoping means impact is bounded by those conditions rather than affecting every installation. The tag 'Authentication Bypass' reflects that the mechanism circumvented the trust normally conferred by the update pipeline, though no authorization weakness in an exposed service component is described. The client's End-of-Support date of October 2021 is the dominant limiting factor for current exploitability.
Know when Live Update gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Malicious code is delivered over the network through the trusted update channel with no privileges or user interaction, yielding full C/I/A impact on the affected device; scope unchanged.
Primary rating from Vendor (54bf65a7-a193-42d2-b1ba-8e150d3c35e1).
CVSS VectorVendor: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1
Lifecycle Timeline
2DescriptionCVE.org
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.
Executive ViewAI
A supply-chain compromise of the ASUS Live Update client - the trusted channel ASUS used to deliver updates to its devices - is confirmed actively exploited (CISA KEV), and affected machines could be driven to perform attacker-chosen actions without any user interaction or credentials. Exposure is narrow but real: only organizations still running unsupported legacy ASUS hardware that installed one of the tampered builds and met the attacker's embedded targeting conditions are at risk, and ASUS states no currently supported products are affected, with Live Update reaching end-of-support in October 2021. Leadership should care because the compromise arrived through a vendor's own update mechanism, eroding trust in third-party update channels generally, and because the residual risk sits on legacy devices that cannot be patched and must instead be retired.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or uninstall the end-of-support ASUS Live Update client and block its outbound update traffic, isolate or retire affected legacy ASUS devices, enforce application allowlisting and network segmentation, and monitor EDR and network telemetry for post-compromise activity.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB