Funforgegames
Technology

CISA reveals warning on Asus software flaw, here's what you need to do to stay safe

December 18, 2025 • 5 min read • views
CISA reveals warning on Asus software flaw, here's what you need to do to stay safe
  1. Pro
  2. Security
CISA reveals warning on Asus software flaw, here's what you need to do to stay safe News By Sead Fadilpašić published 18 December 2025

A poisoned Asus utility tool was found online

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Digital crime by an anonymous hacker (Image credit: Shutterstock) Share Share by:
  • Copy link
  • Facebook
  • X
  • Whatsapp
  • Reddit
  • Pinterest
  • Flipboard
  • Threads
Share this article 0 Join the conversation Follow us Add us as a preferred source on Google
  • CISA added a critical Asus Live Update supply‑chain compromise (CVE‑2025‑59374) to KEV, tied to tampered installers distributed before 2021
  • The flaw stems from the 2018–2019 incident, where attackers implanted malicious code on Asus update servers
  • Federal agencies must remediate by January 7, and security firms urge private organizations to follow suit

The US Cybersecurity and Infrastructure Security Agency (CISA) recently added a new critical vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, meaning it has seen it being abused in the wild.

The vulnerability plagues Asus Live Update, a utility tool that comes preinstalled on many Asus laptops and desktops. It checks Asus servers for updates, and installs them automatically, including BIOS files, firmware, drivers, and more.

According to the National Vulnerability Database (NVD), certain versions of the client were distributed “with unauthorized modifications introduced through a supply chain compromise”. These modified builds allow threat actors to “perform unintended actions” on devices that meet certain targeting conditions. It is also worth mentioning that the Live Update client reached end-of-support in October 2021.

You may like
  • security Asus warns of new security flaw affecting AiCloud routers - here's what we know
  • Ransomware CISA warns Motex Landscope Endpoint Manager has a worrying security flaw, so patch now
  • Malware attack virus alert , malicious software infection , cyber security awareness training to protect business US Government orders patching of critical Windows Server security issue

Owned by AISURU?

The bug is now tracked as CVE-2025-59374 and was given a severity score of 9.3/10 (critical).

The Hacker News notes the vulnerability actually refers to a supply chain attack that was spotted in March 2019. Back then, ASUS acknowledged an advanced persistent threat group breaching some of its servers between June and November 2018.

"A small number of devices have been implanted with malicious code through a sophisticated attack on our Live Update servers in an attempt to target a very small and specific user group," Asus noted back then, releasing version 3.6.8 to address the flaw.

Together with the Asus bug, CISA also added a Cisco flaw affecting multiple products, as well as a bug plaguing SonicWall SMA1000.

Are you a pro? Subscribe to our newsletterContact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsorsBy submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Usually, when CISA adds flaws to KEV, it means that Federal Civilian Executive Branch agencies have a three-week deadline to patch up or stop using the products entirely. For the ASUS flaw, agencies have until January 7 to address it.

While it is not mandatory for organizations in the private sector, security companies usually advise them to follow CISA’s instructions, too.

Best antivirus software headerThe best antivirus for all budgetsOur top picks, based on real-world testing and comparisons

➡️ Read our full guide to the best antivirus1. Best overall:Bitdefender Total Security2. Best for families:Norton 360 with LifeLock3. Best for mobile:McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.

Sead FadilpašićSocial Links Navigation

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Show More Comments

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Logout Read more security Asus warns of new security flaw affecting AiCloud routers - here's what we know    Ransomware CISA warns Motex Landscope Endpoint Manager has a worrying security flaw, so patch now    Malware attack virus alert , malicious software infection , cyber security awareness training to protect business US Government orders patching of critical Windows Server security issue    digital data lock on screen Chinese state hackers may be using VMWare Tools flaw to hack US systems - so patch now, CISA warns    Padlock against circuit board/cybersecurity background CISA warns exploited Cisco flaws are a serious risk, so patch now    Cisco US Government tells agencies to patch Cisco firewalls immediately, or face attack    Latest in Security Code Skull Auto giant LKQ says it's the latest firm to be hit by Oracle EBS data breach    Fingertip pressing keyboard key with Windows logo on it Having Windows app issues? Microsoft is making businesses reach out directly to get a fix    coding AI-generated code contains more bugs and errors than human output    Cisco Cisco says Chinese hackers are exploiting its customers with a new zero-day    PayPal Debit card PayPal user beware - experts warn subscriptions being abused to send fake purchase emails    A hand holding a phone with the AWS logo in front of the AWS logo on an orange background AWS systems targeted by crypto mining scam using hijacked IAM credentials    Latest in News Starfield screenshot in space Bethesda reportedly held a secret Starfield event to showcase an upcoming update that will add faster loading times and technical improvements to the Creation Engine, along with a PS5 port that will be announced in 2026    Fallout x Call of Duty collaboration for Season 01 Reloaded Amazon's Fallout characters are coming to Call of Duty: Black Ops 7 and Warzone Season 01 Reloaded    Divinity trailer screenshot showing a mysterious masked figure reaching out with an audience behind him The RAM crisis may lead to much better game optimization, and that's great    PS5 gaming monitor behind PS5 console, DualSense controller and Pulse 3D headset New data shows that only 1.6 million units of video game hardware were sold in the US in November, making it the worst month since 1995    ExpressVPN's new Qt desktop app on laptop screen – promo image ExpressVPN rolls out major Qt update to boost speed and unify desktop apps    A spatial photo of children blowing out birthday candles taken on the Apple Vision Pro Apple just took spatial photos to another level with this mind-blowing AI tool    LATEST ARTICLES
  1. 13 Wear OS features you're probably not using, but should be
  2. 2Mark Manson on the problem with self-help and why his AI app is different
  3. 3Hurry! Claim your free ByteSim for your next trip to Japan exclusively on TechRadar
  4. 4Alldocube IWork GT Ultra review
  5. 5Bethesda reportedly held a secret Starfield event to showcase an upcoming update that will add faster loading times and technical improvements to the Creation Engine, along with a PS5 port that will be announced in 2026

Related Articles