Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

myasus

An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services.


Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information.

CVE-2025-4570 is a vulnerability identified in the ASUS MyASUS application, specifically versions 4.0.35.0 and earlier. The issue is categorized under CWE-798, which pertains to the use of hard-coded credentials. In this case, MyASUS contains an insecure sensitive key storage flaw where a hard-coded token or credential is embedded within the application. This token can potentially be extracted by an unauthorized actor without requiring any privileges or user interaction. Once obtained, the token may allow the attacker to communicate with certain ASUS services, potentially leading to unauthorized access or manipulation of service interactions. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. The vector metrics show that the attack can be performed remotely (AV:N), with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The impact is limited to confidentiality (VC:L) with no impact on integrity or availability. No known exploits are currently reported in the wild, and no patches have been linked yet, though ASUS has acknowledged the issue in their security advisory. This vulnerability highlights the risks of embedding static credentials in software, which can be extracted and abused by attackers to bypass authentication or gain unauthorized access to backend services.

Detailed information about CVE-2025-4570: CWE-798 Use of Hard-coded Credentials in ASUS MyASUS affecting ASUS MyASUS. Get real-time updates, technical details, 

CVE-2025-4570: CWE-798 Use of Hard-coded Credentials in ASUS MyASUS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4570: CWE-798 Use of Hard-coded Credentials in ASUS MyASUS

CVE-2025-4569 is a high-severity vulnerability identified in the MyASUS application, specifically versions 4.0.35.0 and earlier. The root cause of this vulnerability is the use of hard-coded credentials (CWE-798), which results in insecure sensitive key storage within the application. This flaw potentially allows an unauthorized actor to extract a token embedded in the software. Such a token could be leveraged to communicate with certain backend services that the MyASUS application interacts with. The vulnerability is notable because it does not require any user interaction, privileges, or authentication to exploit, and can be triggered remotely over a network (CVSS vector: AV:N/AC:L/PR:N/UI:N). The impact on confidentiality is limited to the exposure of the token, but this token could enable further unauthorized access or manipulation of services linked to the MyASUS ecosystem. The vulnerability does not affect integrity or availability directly, but the compromise of tokens could lead to secondary attacks or unauthorized actions. The vulnerability has a CVSS 4.0 base score of 7.7, indicating a high severity level. As of the published date, no known exploits are reported in the wild, but the presence of hard-coded credentials is a critical security design flaw that attackers could exploit once a proof-of-concept or exploit code is developed. The vulnerability is specific to the MyASUS software, which is pre-installed or used on ASUS laptops and devices, primarily targeting the ASUS user base for device management and support services.

Detailed information about CVE-2025-4569: CWE-798 Use of Hard-coded Credentials in ASUS MyASUS affecting ASUS MyASUS. Get real-time updates, technical details, 

CVE-2025-4569: CWE-798 Use of Hard-coded Credentials in ASUS MyASUS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-4569: CWE-798 Use of Hard-coded Credentials in ASUS MyASUS


CVE-2025-4570: CWE-798 Use of Hard-coded Credentials in ASUS MyASUSCVE-2025-4570 0 An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information. MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-4570 #cwe-798 Join the discussion	CVE Database V5	07/21/2025, 07:52:00 UTC Added: 07/21/2025, 08:01:46 UTC
CVE-2025-4569: CWE-798 Use of Hard-coded Credentials in ASUS MyASUSCVE-2025-4569 0 An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information. HighVulnerabilityGermanyFranceUnited Kingdom+7#cve #cve-2025-4569 #cwe-798 Join the discussion	CVE Database V5	07/21/2025, 07:51:35 UTC Added: 07/21/2025, 08:01:46 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional