CVE-2025-59374

Attackers modified official ASUS Live Update client distribution packages by introducing unauthorized code (CWE-506: embedded malware) before delivery to end users. Only devices meeting specific conditions (targeting mechanism) and having compromised versions installed were actually activated to execute unintended actions. ASUS Live Update client reached End-of-Support (EOS) status in October 2021 and is no longer supported by the manufacturer.

On devices meeting targeting conditions, attackers could cause unintended, unauthorized actions to be executed — the scope of impact depends on the functions of embedded malicious code. No currently supported ASUS devices or products are vulnerable to this issue.

ASUS Live Update client reached End-of-Support status in October 2021 — the manufacturer will not release a patch for this application. All versions of ASUS Live Update client should be uninstalled and usage discontinued. To verify device status, refer to references published by ASUS at the address indicated in the manufacturer's references.

Selected versions of ASUS Live Update client (versions indicated in manufacturer's references), distributed before reaching End-of-Support status in October 2021. Currently supported ASUS devices and products are not affected by this issue.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.