CISA Flags Critical ASUS Live Update Flaw After Evidence of Active Exploitation

According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, a critical flaw in ASUS Live Update has been added to the Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. The vulnerability is tracked as CVE-2025-59374, has a CVSS score of 9.3 and is described as an embedded malicious code vulnerability introduced via a supply chain compromise.

Certain versions of the ASUS Live Update client were distributed with unauthorized modifications, with the description noting that only devices meeting specific targeting conditions and installed with the compromised builds were affected. The flaw relates to a supply chain attack dating back to March 2019, when ASUS acknowledged an advanced persistent threat campaign known as Operation ShadowHammer by Kaspersky, which involved MAC addresses and a trojanised set of artifacts.

ASUS has fixed the issue in version 3.6.8 of the Live Update software, and the EOS of the Live Update client was announced as of 4 December 2025, with CISA urging FCEB agencies to discontinue use by 7 January 2026; users are advised to update to version 3.6.8 or higher.