CISA warns ASUS Live Update backdoor is still exploitable, seven years on

According to CISA, ASUS has added the ASUS Live Update vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, signalling ongoing exploitation and urgency. The flaw is tracked as CVE-2025-59374 and carries a CVSS score of 9.3, affecting the Live Update utility used to deliver firmware and software updates to ASUS devices.

The incident history cited includes a 2018 supply chain attack attributed to Chinese state‑sponsored attackers and a 2019 response to media reports about attacks on the Live Update tool, which allowed backdoor implants in a small number of devices. Originally, attackers reportedly targeted around 600 specific devices based on hashed MAC addresses, even though millions may have downloaded the compromised utility.

Support for ASUS Live Update has since been discontinued, with the final intended version being 3.6.15, though updates continue to be provided, and users are advised to upgrade to version 3.6.8 or later.