Exploited vulnerability · CISA KEV

Is CVE-2025-59374 exploited? Yes: in CISA KEV since 17 Dec 2025

Gociux · ASUS Live Update · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2025-59374, ASUS Live Update Embedded Malicious Code Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 17 Dec 2025, the day it was published. It affects ASUS Live Update. If you run it, CISA's required action is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What it is

ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

What to do

1. Check whether you run it. Look for Live Update in your asset inventory, including appliances and cloud images. Stack check lists every exploited ASUS CVE at once.
2. Apply the fix. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 17 Dec 2025.
4. Get told next time. Email alerts when CISA adds a CVE for ASUS.

References

• www.asus.com/support/faq/1018727/
• nvd.nist.gov/vuln/detail/CVE-2025-59374

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in December 2025 · ASUS scorecard · act-now radar.