pwn.watch: ASUS incident updates

[critical] ASUS Live Update: Live Update Embedded Malicious Code Vulnerability

Wed, 17 Dec 2025 00:00:00 GMT

ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-12-17.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-12-17: CISA added CVE-2025-59374 to the KEV catalog (due 2026-01-07).

CVEs: CVE-2025-59374

[critical] ASUS Routers: Routers Improper Authentication Vulnerability

Mon, 02 Jun 2025 00:00:00 GMT

ASUS Lyra Mini and ASUS GT-AC2900 devices contain an improper authentication vulnerability that allows an attacker to gain unauthorized access to the administrative interface. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-06-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-02: CISA added CVE-2021-32030 to the KEV catalog (due 2025-06-23).

CVEs: CVE-2021-32030

[high] ASUS RT-AX55 Routers: RT-AX55 Routers OS Command Injection Vulnerability

Mon, 02 Jun 2025 00:00:00 GMT

ASUS RT-AX55 devices contain an OS command injection vulnerability that could allow a remote, authenticated attacker to execute arbitrary commands. As represented by CVE-2023-41346. Added to CISA KEV on 2025-06-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-02: CISA added CVE-2023-39780 to the KEV catalog (due 2025-06-23).

CVEs: CVE-2023-39780