#VU18081 Hidden functionality (backdoor) in ASUS Live Update - CVE-2025-59374
Published: March 26, 2019 / Updated: December 18, 2025
Vulnerability identifier: #VU18081
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2025-59374
CWE-ID: CWE-912
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
ASUS Live Update
ASUS Live Update
Software vendor:
Asus
Asus
Description
The vulnerability allows a remote attacker to compromise vulnerable system
The vulnerability exists due to hidden functionality (backdoor) is present in software. A remote attacker can use this functionality to gain full access to the application and compromise the affected system.
Note: this backdoor was implented as a result of ASUS servers compromise within the APT attack dubbed “Operation ShadowHammer”. The campaign ran from June to at least November 2018.
Remediation
Install a new version of Asus Live Update from vendor's website and use antivirus software to detect and remove potential malware from your computers.
External links
- https://securelist.com/operation-shadowhammer/89992/
- https://www.darkreading.com/attacks-breaches/attackers-compromise-asus-software-update-servers-to-distribute-malware/d/d-id/1334244
- https://www.vice.com/en/article/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers/
- https://www.asus.com/news/hqfgvuyz6uyayje1/