ASUS Live Update Vulnerability Exposes Devices to Supply Chain Risks

What changed

Recent findings have revealed that certain versions of the ASUS Live Update client were distributed with unauthorized modifications due to a supply chain compromise. This vulnerability could lead to unintended actions on devices that installed these compromised versions, provided they met specific targeting conditions.

It is important to note that the affected versions of the Live Update client have already reached End-of-Support (EOS) as of October 2021, which limits the scope of the impact.

Who is affected

While the vulnerability primarily affects older versions of the ASUS Live Update client, it is crucial to identify the groups and products that may have been exposed to this risk.

The following points outline the affected entities:

• ASUS Live Update client versions prior to EOS in October 2021.
• Users who installed the compromised builds on their devices.
• Organizations relying on ASUS products that utilize the Live Update functionality.

What to do

Given the nature of this vulnerability, users and organizations should take proactive measures to mitigate any potential risks.

Recommendations include ensuring that devices are updated with the latest supported software and avoiding the use of unsupported applications.

• Uninstall any outdated versions of the ASUS Live Update client.
• Monitor devices for any unusual behavior that may indicate exploitation.
• Stay informed about vendor updates and security advisories related to ASUS products.