CVE-2025-59374

CVE-2025-59374 involves a supply chain compromise in certain versions of the ASUS Live Update client, which were distributed with unauthorized modifications. These altered builds could cause devices meeting specific targeting conditions to perform unintended actions, classified under CWE-506 (Embedded Malicious Code). Only devices that satisfied these conditions and installed the compromised versions were affected. The Live Update client reached End-of-Support in October 2021, and no currently supported ASUS devices or products are impacted.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), enabling remote exploitation over the network with low complexity, no privileges, and no user interaction. Attackers leveraging the supply chain compromise could target qualifying devices through the modified client, achieving high impacts on confidentiality, integrity, and availability by triggering unintended actions on those systems.

ASUS has issued details via their news advisory at https://www.asus.com/news/hqfgvuyz6uyayje1/, and the issue appears in the CISA Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59374. Given the end-of-support status, no patches are available; mitigation requires verifying that compromised versions are not installed on any legacy devices meeting the targeting conditions.