Live › vulnerability › CVE-2025-59374
Go to dashboardASUS Live Update, the updater software shipped with ASUS PCs, was distributed in modified builds after a supply chain compromise. Devices that match specific targeting conditions could be made to run unintended actions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| asus live update | vendor | < 3.6.8 | 3.6.8 |
| ASUS Live Update | vendor | – | – |
Check whether ASUS Live Update is installed on Windows machines (look for LiveUpdate.exe or the ASUS Live Update app in installed programs).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2025-59374")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.