Security tracker
CVE-2025-59374: ASUS Live Update Embedded Malicious Code Vulnerability
In short
ASUS Live Update has a weakness classified as embedded malicious code (CWE-506). CISA added it to its Known Exploited Vulnerabilities catalog on 2025-12-17. NVD lists CVSS 4.0 at 9.3 CRITICAL.
What it is
“ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.” — CISA KEV, retrieved 2026-11-01
“"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.” — NVD, retrieved 2026-11-01
Who is affected
ASUS Live Update. NVD lists the following versions as affected:
- Versions before 3.6.8
Exploitation status
CISA KEV added: 2025-12-17. Known ransomware campaign use: Not reported by CISA. Due date CISA set for US federal civilian agencies: 2026-01-07.
Scores
NVD CVSS 4.0: 9.3 CRITICAL; vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source 54bf65a7-a193-42d2-b1ba-8e150d3c35e1.
EPSS by FIRST: 1.20%; percentile 68.11; score date 2026-10-31. EPSS estimates the probability of exploitation in the next 30 days.
CWE: CWE-506.
Timeline
| Date | Event |
|---|---|
| 2025-12-17 | CISA KEV added |
| 2025-12-17T05:16:13.080 | NVD published |
| 2026-01-07 | CISA KEV due |
| 2026-09-25T23:10:00.463 | NVD last modified |
| 2026-10-31 | FIRST EPSS score |
CISA required action
“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.” — CISA KEV
What to do
- Confirm whether you run ASUS Live Update and which version.
- Apply the vendor update or mitigation in the advisory.
- Follow CISA’s required action.
- Review the vendor guidance on signs of compromise.
- Track the fix through completion.
Sources and dates
CISA Known Exploited Vulnerabilities Catalog, version 2026.10.30; retrieved 2026-11-01. CISA KEV data: CC0 1.0. No endorsement by CISA.
NVD retrieved: 2026-11-01. This product uses the NVD API but is not endorsed or certified by the NVD.
EPSS scores by FIRST; score date 2026-10-31.
Check your own domain's public security settings
The snapshot checks a domain you own or are authorized to check for DNS, HTTPS/TLS and web-header hygiene. It does not test for this CVE.