CVE-2025-59374 ASUS Live Update: hidden backdoor
In plain words: The software was shipped with hidden malicious code inside it. Whoever planted it has secret access to every copy.
Confirmed exploited by CISA on · US federal patch deadline Jan 7, 2026
What to do
- Install ASUS's security update for Live Update. If no update exists, follow the vendor's workaround or stop using the product until one ships.
- Install system updates the day they come out — most phone zero-days are fixed in a point release.
- Restart your phone every few days; some spyware does not survive a reboot.
- If you are a journalist, activist, lawyer, politician or executive, turn on Lockdown Mode (iPhone) or Advanced Protection (Android).
Who is affected
Could reach you. This one is aimed at devices or apps of the kind people own.
What's at risk: Messages, photos, location, microphone and camera. The most serious ones are "zero-click": no tap needed from the owner. They are usually used as spyware against a small number of chosen people.
The details
- Official name
- ASUS Live Update Embedded Malicious Code Vulnerability
- Product
- ASUS Live Update
- CISA description
- ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Type of flaw
- Hidden backdoor (CWE-506)
- Confirmed exploited
- Dec 17, 2025
- US federal patch deadline
- Jan 7, 2026
Ask Cleus about it
Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.
Answering about CVE-2025-59374 ·
Questions about CVE-2025-59374
Is CVE-2025-59374 being exploited?
Yes. CISA added CVE-2025-59374 to its Known Exploited Vulnerabilities catalog on Dec 17, 2025, which means there is reliable evidence of real-world attacks.
How do I fix CVE-2025-59374?
Install ASUS's security update for Live Update. If no update exists, follow the vendor's workaround or stop using the product until one ships. Install system updates the day they come out — most phone zero-days are fixed in a point release.
Am I affected by CVE-2025-59374?
Only if you use ASUS Live Update. This one is aimed at devices or apps of the kind people own.