ASUS Live Update Supply Chain Compromise (CVE-2025-59374)

Historical catalog analysis: CISA added this entry on December 17, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-59374 describes a supply chain compromise affecting ASUS Live Update. Unauthorized modifications were introduced into the product’s build process, resulting in the distribution of clients containing embedded malicious code (CWE-506). If specific targeting conditions are met on a device, these modified builds could cause the system to perform unintended actions.

Exposure and applicability

This vulnerability applies to organizations utilizing ASUS Live Update. The risk is centered on the presence of compromised software binaries rather than a traditional flaw in the code’s logic. Because the product may be end-of-life (EoL) or end-of-service (EoS), some environments may be running legacy versions without active vendor support, increasing the difficulty of identifying and updating affected assets.

Potential breach-prevention strategy

The reported entry path was a supply chain compromise where unauthorized modifications were embedded into official builds. It remains unknown exactly how the build pipeline was accessed or which specific targeting conditions trigger the malicious behavior.

Our analysis suggests that a similar incident could have reduced its likelihood through the following prioritized actions:

1. Software Inventory and EoL Audit: Identify all instances of legacy update utilities (like ASUS Live Update) across the fleet. A vulnerability management lead should verify this via an asset inventory to ensure EoL software is not remaining on production systems.
2. Application Execution Control: Implement policies that restrict the execution of non-essential vendor utilities in sensitive environments. This hypothetical control would limit the ability of a compromised binary to execute, regardless of its origin. A security engineer could verify this through policy audit logs.
3. Network Egress Filtering: Restrict outbound communication from system utility folders to known-good vendor endpoints. While this does not prevent initial compromise, it could reduce the likelihood of a compromised build communicating with an external actor. This can be verified via firewall or proxy logs.

Remediation priorities

Defenders should prioritize the following actions based on available source guidance:

• Immediate Decommissioning: Given that the product may be EoL/EoS, the primary recommendation is to discontinue the use of ASUS Live Update entirely.
• Vendor Mitigations: If decommissioning is not immediately feasible, apply mitigations as specified in vendor instructions.
• Asset Identification: Scan environments for the presence of the ASUS Live Update client to determine the scope of exposure.

How to validate remediation

Verification must go beyond a simple version check, as the compromise occurred within the build process itself. To verify that exposure has been reduced:

• Removal Confirmation: Confirm the complete removal of the software binaries from the filesystem across all affected endpoints.
• Mitigation Audit: If vendor mitigations were applied instead of removal, verify the specific configuration changes or patches mandated by the vendor are active on the host.
• Execution Block: Verify that the application is no longer running in memory and cannot be launched by users or system processes.

Limits and open questions

There is residual risk if the compromised software was used to deploy further persistence mechanisms before it was removed. The source does not specify the exact “targeting conditions” required for the malicious code to activate, leaving defenders uncertain about which specific systems are at highest risk. Additionally, because the product’s EoL/EoS status is noted as a possibility rather than a confirmed fact for all versions, organizations must verify the support status of their specific deployment.

Source and editorial note

CVE-2025-59374: ASUS Live Update Embedded Malicious Code Vulnerability · Source date: December 17, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 20, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 25, 2026 at 00:33 UTC.

Request a Vulnerability Assessment