ASUS Live Update Vulnerability CVE-2025-59374: Understanding the Real Threat

In the world of cybersecurity, older vulnerabilities often resurface when added to prominent databases like the CISA Known Exploited Vulnerabilities (KEV) catalog. The recent inclusion of ASUS Live Update’s CVE-2025-59374 has sparked alarm across various infosec platforms, with some reports suggesting the vulnerability is part of a newly emerging threat. However, a closer look reveals a more complex story behind this CVE.

The vulnerability in question traces back to a 2018-2019 supply-chain attack called “ShadowHammer,” during which maliciously modified ASUS Live Update binaries were deployed to a select group of targeted systems. Despite its historical roots, the CVE is receiving renewed attention because it has now been formally cataloged by CISA as a Known Exploited Vulnerability. But does this mean users should panic or take immediate action? Let’s dive deeper into the details to understand the real implications.

Summary of the Vulnerability

CVE-2025-59374 has been associated with a supply-chain compromise in the ASUS Live Update client. This attack, which took place in 2018-2019, involved unauthorized modifications to ASUS’s Live Update software, leading to selective delivery of the altered versions to vulnerable devices. The compromised software could trigger unintended actions on affected systems, but only if they met specific targeting conditions.

The CVE itself documents that the impacted version of ASUS Live Update was already End-of-Life (EoL) by October 2021. This suggests that the software in question is no longer in use on currently supported devices. ASUS has long since discontinued updates for the affected version, and the last advisory on this issue was published in 2019.

The recent update to the FAQ page on ASUS’s website, dated December 2025, simply restates the End-of-Support (EOS) announcement for the Live Update software, which came into effect in 2021. The FAQ page, while updated, has not introduced any new information regarding the vulnerability, further confirming that the attack is not a current security risk.

Despite this, the addition of the CVE to CISA’s KEV catalog has reignited discussions, with some misinterpreting it as a fresh threat. In reality, this vulnerability has been well-known since 2019, and its cataloging is more of a retrospective documentation effort than a signal of new exploitation.

What Undercode Say:

While the inclusion of this vulnerability in the KEV catalog may seem like a new security threat, it’s essential to consider the broader context before jumping to conclusions. Historically, vulnerabilities like CVE-2025-59374 have resurfaced in infosec discussions due to the formal process of cataloging older issues. This doesn’t necessarily imply that new exploitation is occurring or that there’s a sudden, widespread risk.

The fact that the vulnerability was associated with an End-of-Life software product, ASUS Live Update, further mitigates the risk. As per the CVE documentation, only systems using the outdated and unsupported software were affected. Modern devices, which have long since moved beyond this version, are not at risk.

Furthermore, the added attention from the cybersecurity community may be a result of a misunderstanding of the CVE’s implications. The issue is certainly critical in its historical context, but it does not warrant the same urgency that often accompanies a fresh security threat. As noted by CISA, the inclusion of older vulnerabilities in the KEV catalog does not indicate active exploitation.

For security teams, this serves as a reminder of the need to treat CVEs related to obsolete products with caution. It’s essential to assess whether the threat is relevant to your current infrastructure and whether immediate patching is required.

Fact Checker Results:

✅ The CVE is linked to a well-documented historical attack from 2018-2019.
❌ No new exploitation of the vulnerability has been confirmed or reported.
✅ The vulnerability affects End-of-Life software, which is no longer in use on most modern systems.

Prediction:

Looking ahead, CVE-2025-59374 is unlikely to present a significant risk to most organizations. The real lesson here is the importance of reviewing the context of vulnerabilities and recognizing when older issues resurface in security databases. As newer versions of software continue to evolve, the focus should be on securing active systems and staying up to date with the latest patches for currently supported products.