CVE-2025-59374 KEV
9.8
CRITICAL · CVSS 3.1 · EPSS 1.2% (pctl 67)
Patch first
On CISA KEV — known exploited in the wild, due 2026-01-07.
Description
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 1.2% — more likely to be exploited than 67% of all CVEs |
| Weakness | CWE-506 |
| On CISA KEV | yes — remediate by 2026-01-07 |
| Public exploit | none known |
| Published | 2025-12-17 |
| Last modified | 2026-09-25 |
CISA KEV
| Name | ASUS Live Update Embedded Malicious Code Vulnerability |
|---|---|
| Added | 2025-12-17 |
| Due | 2026-01-07 |
| Vendor / product | ASUS / Live Update |
| Ransomware use | none reported |
Affected (1)
| Vendor | Product |
|---|---|
| asus | live update |
References
→ the Explorer · watch your stack · NVD