Report · SecurityWeekAbout CVE-2025-59374Published 18 Dec 2025

CISA Warns of Exploited Flaw in Asus Update Tool

Source SecurityWeek

Authoritative record:CVE-2025-59374· Critical 9.3

Exploited in the wild · KEV due 7 Jan 2026 : apply the vendor's fix or mitigations to affected systems now.

Data as of 26 Oct 2026, 08:30 UTC

CVSS 4.0 base score

9.3Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 7 Jan 2026 US federal agencies must patch by this date; a sensible deadline for everyone else.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 17 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV the same day as disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by ASUS
15 Sep 202501:36 UTC, 93 days before disclosure
CVE published
on cve.org
17 Dec 202504:27 UTC, t = 0
In Threat Radar
record ingested
17 Dec 202504:45 UTC, 18 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
17 Dec 2025, the same day as disclosure
KEV remediation due
US federal deadline
7 Jan 2026, 21 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

1. Immediately verify the integrity of the Asus Live Update tool on all devices by comparing checksums with official sources or reinstalling from trusted media. 2. Temporarily disable or restrict the Asus Live Update service/network access until a verified patch or official guidance is available. 3. Implement network segmentation and strict firewall rules to limit the update tool’s communication to only trusted Asus update servers. 4. Deploy endpoint detection and response (EDR) solutions to monitor for unusual process behavior or network activity related to the update tool. 5. Conduct thorough audits of systems for signs of compromise, including unexpected processes, scheduled tasks, or network connections. 6. Educate IT staff and users about the threat to avoid inadvertent execution of suspicious updates or files. 7. Stay updated with advisories from Asus, CISA, and other cybersecurity authorities for patches or further instructions. 8. Consider application whitelisting to prevent unauthorized code execution via the update tool. 9. Review and strengthen supply chain security policies to detect and prevent similar attacks in the future.

Description

Tracked as CVE-2025-59374, the issue is a software backdoor implanted in Asus Live Update in a supply chain attack. The post CISA Warns of Exploited Flaw in Asus Update Tool appeared first on SecurityWeek .

Impact

For European organizations, the presence of a backdoor in the Asus Live Update tool could lead to unauthorized remote code execution, enabling attackers to gain persistent access to systems. This could compromise confidentiality by exposing sensitive data, integrity by allowing unauthorized modifications, and availability by potentially disrupting system operations. Sectors such as government, finance, healthcare, and critical infrastructure that utilize Asus devices may face increased risks of espionage, data breaches, or operational disruptions. The supply chain nature of the attack complicates detection and response, as the compromised update tool is inherently trusted. The medium severity suggests that while the threat is serious, exploitation may require specific conditions or user interaction. Nonetheless, the potential for stealthy, persistent access makes this a significant concern for European entities, especially those with high Asus device usage or strategic importance in technology and manufacturing.

References

securityweek.com/cisa-warns-of-exploited-flaw-in-asus-update-tool/ (opens in a new tab)

Community reviews

Loading reviews…