CVE-2025-59374

Published Dec 17, 2025

Last updated 6 days ago

ASUS Live Update

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59374 refers to a vulnerability affecting certain versions of the ASUS Live Update client, which were distributed with unauthorized modifications due to a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. This vulnerability is related to a supply chain attack, known as Operation ShadowHammer, where an advanced persistent threat (APT) group breached ASUS servers between June and November 2018. The attackers implanted malicious code, targeting a small group of users identified by their network adapter's MAC addresses. Although the issue was fixed in version 3.6.8, the Live Update client reached end-of-support on December 4, 2025.

Description: "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.
Source: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1
NVD status: Analyzed
Products: live_update

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: ASUS Live Update Embedded Malicious Code Vulnerability
Exploit added on: Dec 17, 2025
Exploit action due: Jan 7, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

54bf65a7-a193-42d2-b1ba-8e150d3c35e1: CWE-506

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:asus:live_update:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "649A2172-4D6A-491F-A8CF-1CD0D253B879",
            "versionEndExcluding": "3.6.8"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.