CVE-2025-59374

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-59374 9.8

ASUS · Live Update · Added 2025-12-17 · Published 2025-12-17

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityASUS Live Update Embedded Malicious Code Vulnerability

VendorASUS

ProductLive Update

Date added2025-12-17

Due date2026-01-07

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-506

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

NVD: "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-06-13 08:06 UTC

Wall time0.6s

Searches3

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-59374
https://www.asus.com/support/faq/1018727/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59374
https://www.bleepingcomputer.com/news/security/cisa-flags-asus-live-update-cve-but-the-attack-is-years-old/
https://www.securityweek.com/cisa-warns-of-exploited-flaw-in-asus-update-tool/
https://www.malwarebytes.com/blog/news/2025/12/cisa-warns-asus-live-update-backdoor-is-still-exploitable-seven-years-on
https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/
https://securelist.com/operation-shadowhammer/89992/
https://www.kaspersky.co.uk/about/press-releases/shadow-hammer
https://cert.europa.eu/publications/security-advisories/2019-007/pdf
https://www.sentinelone.com/vulnerability-database/cve-2025-59374/
https://www.rapid7.com/db/vulnerabilities/asus-live-update-client-cve-2025-59374/

QC notes

warn component_extraction: Component 'ASUS Live Update installer binary (setup.exe) — the signed ASUS Live Update utility distributed through official ASUS update servers (liveupdate01s.asus.com, liveupdate01.asus.com); pre-installed on most ASUS systems for automatic BIOS, UEFI, driver and application updates' matches or contains product name 'Live Update' — no specific component identified

Hunting hypothesis agent

Hunt for ASUS Live Update installations exhibiting unauthorized binary modifications consistent with the supply chain compromise targeting specific system configurations.

Research details

ComponentASUS Live Update installer binary (setup.exe) — the signed ASUS Live Update utility distributed through official ASUS update servers (liveupdate01s.asus.com, liveupdate01.asus.com); pre-installed on most ASUS systems for automatic BIOS, UEFI, driver and application updates

PreconditionsNo authentication required; device must have ASUS Live Update installed (pre-installed on most ASUS computers); device MAC address must match one of approximately 600 hardcoded target MAC addresses in the trojanized binary; affected versions prior to 3.6.8; attacker must have compromised ASUS software build/distribution infrastructure to inject malicious code into signed binaries; victim must download compromised update from official ASUS update servers during the June-November 2018 attack window agent

DeliverySupply chain compromise — attackers injected malicious code into the ASUS Live Update build pipeline; trojanized binaries (setup.exe) were signed with legitimate ASUSTeK Computer Inc. code signing certificates and hosted on official ASUS update servers (liveupdate01s.asus.com and liveupdate01.asus.com); distribution occurred via the automatic update mechanism built into ASUS Live Update, which checked for and downloaded updates from official servers; users who had Live Update installed (pre-installed on most ASUS devices) would automatically download and install the compromised update without any user interaction required beyond normal software update behavior

Public PoCno

Advisoryhttps://www.asus.com/support/faq/1018727/

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8); part of Operation ShadowHammer (June-November 2018) attributed to APT41/BARIUM (Chinese state-sponsored, also known as Brass Typhoon, Wicked Panda); attackers used legitimate ASUSTeK Computer Inc. code signing certificates to sign trojanized binaries; targeted ~600 specific MAC addresses out of ~1M+ potentially affected users; the attack was uncovered by Kaspersky in January 2019; ASUS released remediated version 3.6.8 in March 2019; Live Update reached End-of-Support (EOS) in October 2021; final version is 3.6.15

SummaryCVE-2025-59374 documents the Operation ShadowHammer supply chain compromise of ASUS Live Update, a sophisticated attack that took place between June and November 2018. Attackers from the APT41/BARIUM group (Chinese state-sponsored) gained access to ASUS's software build infrastructure and injected malicious code into legitimate ASUS Live Update installer binaries (setup.exe). The trojanized binaries were signed with valid ASUSTeK Computer Inc. code signing certificates, making them appear completely legitimate to users and security software. The compromised updates were hosted on and distributed from official ASUS update servers (liveupdate01s.asus.com, liveupdate01.asus.com). The backdoor contained a hardcoded list of approximately 600 unique MAC addresses; it would only activate the next-stage payload if the victim's device MAC address matched one of these targeted entries. All other infected devices showed no malicious network activity, which helped the attack remain undetected for months. While over 1 million users downloaded the compromised installer, only the specifically targeted devices were actively exploited. Kaspersky Lab discovered the attack in January 2019 and coordinated disclosure with ASUS. ASUS released a remediated version (3.6.8) in March 2019. The Live Update client has reached End-of-Support (EOS) as of October 2021, with the final version being 3.6.15. CISA added this CVE to the KEV catalog in December 2025, documenting the historic active exploitation for federal civilian agencies.

Tia coverage

First reported2026-09-13

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cve-2025-59374-asus-live-update-contains-malicious-code-actively

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.