Hackers Love Asus Live Update: A Comedy of Errors in Cybersecurity!
Hackers are exploiting a vulnerability in the now-defunct Asus Live Update utility, warns CISA. The flaw, CVE-2025-59374, is linked to Operation ShadowHammer, a supply chain attack by Chinese state-sponsored hackers. CISA advises discontinuing use of the utility, urging immediate action from federal agencies.
Hot Take:
Who knew that updating your Asus device could be your Achilles’ heel? In the grand tradition of surprise plot twists, your favorite utility has turned into an unintentional spy, courtesy of a shadowy alliance of hackers and discontinued software. Buckle up, Asus users, your firmware might be having a secret rendezvous with APT41!
Key Points:
- CISA warns of a critical Asus Live Update vulnerability, known as CVE-2025-59374, with a high CVSS score of 9.3.
- The vulnerability stems from a sophisticated supply chain attack called Operation ShadowHammer by Chinese state-sponsored hackers.
- Over 1 million users potentially affected, but hackers targeted only 600 specific devices.
- Asus discontinued the Live Update utility but recommends updating to version 3.6.8 or higher.
- Federal agencies have been given a three-week deadline to identify and address vulnerable products.
Already a member? Log in here