CVE-2025-59374

What it actually does

This issue is a supply-chain compromise of certain unsupported ASUS Live Update client builds. The affected updater was distributed with unauthorized code that could execute on endpoints that installed the compromised version. Because update clients commonly run as trusted software and may have elevated privileges, the modified client could perform unintended actions on selected devices after evaluating targeting conditions. The flaw is not a conventional memory corruption bug; it is malicious code embedded in a vendor-distributed update component.

Why it matters to the business

Organizations with legacy ASUS systems may have unknowingly installed a trusted but compromised update client, creating a risk of targeted endpoint compromise, persistence, data theft, follow-on malware deployment, or lateral movement. The product reached end of support in October 2021, so there is no normal supported patch path for the affected client. This is listed in CISA KEV with remediation due by 2026-01-07, indicating confirmed exploitation in the wild and requiring urgent asset discovery, removal, and forensic review even though the EPSS score is relatively low.

How an attack unfolds

An attacker compromises the software supply chain for the ASUS Live Update client and introduces unauthorized modifications into specific distributed builds. A device installs or runs the compromised updater through what appears to be a legitimate vendor update process. Once executed, the modified client checks whether the device matches the attacker’s targeting criteria. If the device matches, the client can initiate unintended actions such as downloading or executing additional code, modifying the system, or enabling later attacker access. Devices that did not install the compromised build, or did not meet the targeting conditions, may not show payload execution but should still be treated as exposed if the compromised client was present.

How to fix it

Remove ASUS Live Update from all systems where it is present, especially because the client reached end of support in October 2021. Replace affected legacy software and unsupported devices with currently supported alternatives. If ASUS has provided any cleanup utility, advisory-specific detection content, or known-good installer guidance, use only files obtained directly from official ASUS support channels. Block execution of legacy ASUS Live Update binaries where they are no longer required. Reimage systems that show evidence of payload execution or post-compromise activity. For KEV compliance, complete remediation or documented mitigation by 2026-01-07.

How to confirm the fix worked

Confirm that ASUS Live Update is no longer installed by checking installed application inventory, endpoint management data, file-system paths, running processes, services, scheduled tasks, and registry uninstall entries. Verify that no legacy ASUS Live Update executables remain in common installation directories. Review software inventory for installation dates and binary metadata associated with ASUS Live Update. Validate that application control or endpoint protection policies block unsupported ASUS Live Update binaries from executing. For systems that previously had the client installed, perform forensic triage to confirm whether the modified updater executed and whether any child processes, network connections, persistence mechanisms, or secondary payloads were created.

Typical attack path

1. Compromise or abuse the vendor update distribution path for the ASUS Live Update client.
2. Publish or distribute a modified ASUS Live Update build that appears legitimate to users and endpoint controls.
3. Wait for legacy ASUS devices to install or execute the compromised updater.
4. Run targeting logic on the endpoint to determine whether the device is of interest.
5. On matched devices, perform unintended actions such as payload retrieval, code execution, persistence, or system modification.
6. Use the compromised endpoint for follow-on activity such as credential access, data collection, command-and-control, or lateral movement.

How to detect it

Hunt first for exposure, then for execution and follow-on behavior. Use software inventory, EDR telemetry, Windows Event Logs, Sysmon, application control logs, proxy/DNS logs, firewall logs, and forensic file-system timelines. Search for installation or execution of ASUS Live Update after the affected distribution period, especially on unsupported legacy ASUS devices. Review process creation events for ASUS Live Update spawning command shells, scripting engines, archive utilities, installers, downloaders, or unknown executables. Check DNS and proxy logs for unusual outbound connections from ASUS Live Update processes. Inspect scheduled tasks, services, Run keys, startup folders, and recently created executables around the time the updater ran. Because only targeted devices may have received follow-on actions, absence of a second-stage payload does not prove the compromised updater was harmless. If exploitation is suspected, preserve the ASUS Live Update binaries, collect hashes, compare signatures and timestamps against vendor-known-good versions, and perform endpoint-wide triage for persistence, credential access, lateral movement, and data staging.

• ASUS Live Update
• LiveUpdate.exe
• ASUS Live Update.exe
• C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
• C:\Program Files\ASUS\ASUS Live Update\LiveUpdate.exe
• C:\Program Files (x86)\ASUS\ASUS Live Update\
• C:\Program Files\ASUS\ASUS Live Update\
• HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ASUS Live Update
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASUS Live Update
• asushotfix.com

What your security team should do

• Immediately inventory endpoints for ASUS Live Update, legacy ASUS update utilities, and associated binaries.
• Prioritize removal or isolation of any endpoint with ASUS Live Update present, because the product is end-of-support and the vulnerability is in CISA KEV.
• Perform forensic review on endpoints where the client was installed or executed, even if no obvious user impact is visible.
• Hunt for suspicious child processes, network connections, scheduled tasks, services, or files created by ASUS Live Update executables.
• Block known legacy ASUS Live Update executable paths and process names using EDR, application control, or software restriction policies where operationally safe.
• Ensure procurement and endpoint lifecycle processes retire unsupported OEM update utilities from managed systems.
• Track ASUS and CISA advisories for any updated indicators, tooling, or remediation instructions before the 2026-01-07 KEV due date.