Critical severity · published Dec 17, 2025
CVE-2025-59374
ASUS Live Update Embedded Malicious Code Vulnerability
In wildKEV
9.8
CVSS
1.2%
EPSS
Yes
On KEV
Description
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 17, 2025
Federal remediation dueJan 7, 2026
Ransomware campaign useNot known
Affected products
Which versions
LU
live update · ASUS
before 3.6.6 · source: vendor, NVD, KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-59374: ASUS Live Update - ASUS Live Update Embedded Malicious Code Vulnerability
ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
LULive UpdateCVE-2025-59374
Dec 17, 2025·CISA KEV