CVE-2025-59374

Certain builds of the ASUS Live Update automatic-update client were distributed containing unauthorized code planted through a supply chain compromise (CWE-506, embedded malicious code). The embedded code only caused devices to perform unintended actions when the device met specific attacker-defined targeting conditions and had installed one of the compromised versions, so most installations of the utility were not visibly affected. Where the targeting conditions were met, the malicious code ran with no user privileges required and carried high impact to confidentiality, integrity and availability (CVSS 4.0 score 9.3, critical). The Live Update client reached End-of-Support in October 2021, and ASUS states that no currently supported devices or products are affected, so exposure is limited to legacy systems that installed the compromised builds. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2025-12-17 after evidence of active exploitation; no public proof-of-concept is known and EPSS estimates a 1.2% probability of exploitation in the next 30 days (66th percentile).

What to do: Because Live Update is end-of-support, no patched release exists: inventory legacy ASUS systems that currently or previously ran the client, determine whether compromised builds were installed, and remove or discontinue the utility per the CISA KEV required action (apply vendor mitigations or discontinue use, with BOD 22-01 applying to federal agencies). Check ASUS security advisories for indicators of the compromised versions and hunt on legacy ASUS endpoints for unexpected outbound connections or other signs of the 'unintended actions' described. Supported ASUS products are not affected, so no action is needed on current, in-support devices.