Live Update
Monthly
Compromised builds of the ASUS Live Update client, distributed through ASUS's own trusted update channel, could cause devices to perform unintended actions, constituting a supply-chain compromise that is now confirmed actively exploited (CISA KEV). Only devices that installed one of the specific modified builds and also met the attacker's embedded targeting conditions were affected, so the campaign was selective rather than universal; no victim authentication or interaction was needed on an affected target (PR:N/UI:N per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Realistic present-day exposure is confined to unsupported legacy devices, because the Live Update client reached End-of-Support in October 2021 and ASUS states no currently supported products are affected; EPSS is 1.20% (67th percentile).
Compromised builds of the ASUS Live Update client, distributed through ASUS's own trusted update channel, could cause devices to perform unintended actions, constituting a supply-chain compromise that is now confirmed actively exploited (CISA KEV). Only devices that installed one of the specific modified builds and also met the attacker's embedded targeting conditions were affected, so the campaign was selective rather than universal; no victim authentication or interaction was needed on an affected target (PR:N/UI:N per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Realistic present-day exposure is confined to unsupported legacy devices, because the Live Update client reached End-of-Support in October 2021 and ASUS states no currently supported products are affected; EPSS is 1.20% (67th percentile).