CISA Warns of Exploited Flaw in Asus Update Tool

18 December 2025: according to CISA, hackers have been exploiting a critical vulnerability in the now-discontinued Asus Live Update utility, tracked as CVE-2025-59374 with a CVSS score of 9.3, described as an embedded malicious code vulnerability introduced via a supply chain compromise.

The alert recalls Operation ShadowHammer, a 2018 supply chain attack attributed to APT41 (also tracked as Brass Typhoon, Wicked Panda and Barium), which injected a backdoor into Asus Live Update used for updating BIOS, UEFI, drivers and other components. Although more than 1 million Asus users downloaded the backdoored utility, the attackers reportedly targeted around 600 specific devices based on hashed MAC addresses embedded in versions of the tool.

Asus released a patch in March 2019 after the attack was uncovered, and later advised that support for the Live Update application has been discontinued, with the final version being 3.6.15; users are urged to update to version 3.6.8 or higher to resolve security defects. CISA’s Known Exploited Vulnerabilities catalog now lists CVE-2025-59374, and federal agencies are advised to stop using the utility under Binding Operational Directive 22-01, with a three‑week window to identify vulnerable products and mitigate.