Actively exploited · Published Dec 17, 2025 · Assigned by ASUS
CVE-2025-59374
Critical 9.3 Exploited
In plain English
A critical-severity security flaw in live update from ASUS. Attackers are actively exploiting it in the wild (listed by CISA on December 17, 2025). The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jan 7, 2026.
Official description
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ASUS | live update | before 3.6.6 |
Weakness: CWE-506 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.asus.com/news/hqfgvuyz6uyayje1/ vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59374 government-resource