CVE-2025-59374Critical· 9.8▾ Hadal⚠ Exploited in the wild0day"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting…
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 53.9 · likelihood 0.2 · exploitation 25
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Jan 7, 2026
Last analysed / modified upstream
1.2%
Added to the CISA catalog on Dec 17, 2025. Federal remediation due Jan 7, 2026. View catalog ↗
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.
live_update < 3.6.8Upgrade past the affected range:
live_update 3.6.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48027Critical· 9.8Nx Console is the user interface for Nx & Lerna
CVE-2025-30066High· 8.6tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs
CVE-2026-88781Medium· 6.8Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing …
CVE-2026-93489High· 8.7Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update f…
CVE-2026-75779High· 8.6Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing websit…
CVE-2026-75775High· 7.7Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-…