ASUS Live Update: Live Update Embedded Malicious Code Vulnerability
ASUS Live Update
ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-12-17.
Why this severity: CVSS 9.3 (CNA, v4.0); actively exploited (CISA KEV)
- Started
- Dec 17, 2025
- Closed
- Dec 17, 2025
Affected
- See vendor advisory / CISA notes (versions not always listed in KEV feed)
Fixed in
- See vendor advisory linked in sources
Timeline1
CISA added CVE-2025-59374 to the KEV catalog (due 2026-01-07).
Advisories3
Notes & caveats
Derived from CISA KEV JSON feed catalogVersion 2026.10.21. CVSS from the CVE record (cvelistV5). Exact affected/fixed version strings are not always in the KEV record; verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier; many entries are older CVEs newly confirmed as exploited in 2025). KEV says affected products could be end-of-life, so some devices may never get a fix.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
