CVE-2025-59374
Published: December 17, 2025
Official Description
ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
CISA KEV Advisory
ASUS Live Update Embedded Malicious Code Vulnerability
ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This critical vulnerability in ASUS Live Update stems from embedded malicious code introduced via a supply chain compromise, allowing unauthorized modifications. With a CVSS score of 9.8 and an EPSS score of 0.31785, coupled with its presence in the KEV catalog, this flaw poses an extremely urgent threat for devices meeting specific targeting conditions.
This vulnerability is actively exploited in the wild, as confirmed by its presence in the KEV catalog. The remote exploitability (AV:N) and low complexity (AC:L) make it a highly accessible target for attackers.
Discontinue utilization of the impacted ASUS Live Update product immediately, as it may be End-of-Life (EoL) or End-of-Service (EoS). Users should remove or disable the affected software to prevent further compromise.
Technical Analysis
CVE-2025-59374 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CISA has added CVE-2025-59374 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-59374 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1