CVE-2025-59374

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Sep 25, 2026

Description

"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-506

Affected software

No affected versions have been published.

Timeline

Published
Dec 17, 2025
Last modified
Sep 25, 2026
Added to CISA KEV
Dec 17, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-593757.5libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsiCVE-2025-593765.3feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-deleCVE-2025-593779.8feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is usCVE-2025-593785.7In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular CVE-2025-593797.5DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SCVE-2025-59384.3The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versCVE-2025-593804.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administratCVE-2025-593814.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administratCVE-2025-593821.2QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:CVE-2025-593839.1A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability CVE-2025-593847.5A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contCVE-2025-593859.8An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers