CISA Warns ASUS Live Update Backdoor Still Exploitable After Seven Years
Critical
Executive Summary
CISA has added the ASUS Live Update backdoor, CVE-2025-59374, to its Known Exploited Vulnerabilities catalog, highlighting that it is still being actively exploited seven years after the original supply chain attack. The vulnerability involves a backdoor implanted in the ASUS Live Update utility, allowing attackers to perform unintended actions on affected devices.
Vulnerability Details
Affected Product: ASUS Live Update (last version is 3.6.15), a utility pre-installed on most ASUS devices
Identifier: CVE-2025-59374
CVSS Score: 9.3 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate action is required, especially for organizations using ASUS devices for critical operations.
Attack Vector: The vulnerability was introduced via a supply chain compromise, where attackers injected a backdoor into the ASUS Live Update utility. This allowed them to bypass traditional security controls and execute arbitrary code.
Ease of Exploit: The exploit is considered easy because the compromised update mechanism allows attackers to bypass security measures.
Action Plan
Immediate Action: Discontinue using the ASUS Live Update utility and update to version 3.6.8 or higher if continued use is necessary. For Federal Civilian Executive Branch (FCEB) agencies, discontinue use by January 7, 2026.
Workaround: Verify the integrity of the ASUS Live Update tool by comparing checksums with official sources or reinstalling from trusted media. Restrict network access for update processes and monitor for unusual activity related to ASUS update services.
Detection: Check for the presence of a file called “.idx.ini” in the user directory, which indicates a backdoored update was run. Review system logs for suspicious activity.
Relevant professional terms
Supply Chain Attack
A cyberattack that targets vulnerabilities in the supply chain, which includes third-party vendors, suppliers, and partners, to compromise the final product or service.
Backdoor
A hidden entry point into a system or application that bypasses normal security measures, allowing unauthorized access.
CISA Adds WatchGuard Firebox Out-of-Bounds Write Vulnerability to Catalog
Critical
Executive Summary
CISA has added CVE-2025-14733, a critical out-of-bounds write vulnerability in WatchGuard Firebox firewalls, to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. This vulnerability allows remote, unauthenticated attackers to execute arbitrary code on affected systems.
Vulnerability Details
Affected Product: WatchGuard Fireware OS versions 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.5, and 2025.1 through 2025.1.3
Identifier: CVE-2025-14733
CVSS Score: 9.3 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching or mitigation is critical due to active exploitation and potential for remote code execution.
Attack Vector: Remote, unauthenticated attackers can exploit the vulnerability through specially crafted requests targeting the IKEv2 key exchange process.
Ease of Exploit: Exploitation is considered low complexity and does not require user interaction.
Action Plan
Immediate Action: Upgrade to Fireware OS versions 2025.1.4, 12.11.6, or 12.5.15. Note that version 11.x is end-of-life and has no fix.
Workaround: Disable dynamic peer Branch Office VPNs, add new firewall policies, and disable default system policies that handle VPN traffic as a temporary mitigation.
Detection: Monitor logs for "Invalid peer certificate chain" messages, abnormally large IKE_AUTH request CERT payloads (greater than 2000 bytes), and iked process crashes or hangs. Check for connections to known malicious IP addresses: 45.95.19[.]50, 51.15.17[.]89, 172.93.107[.]67, and 199.247.7[.]82.
Relevant professional terms
Out-of-Bounds Write
A type of software vulnerability where the program writes data beyond the allocated buffer, potentially causing a crash, corruption of data, or arbitrary code execution.
IKEv2 (Internet Key Exchange version 2)
A protocol used to establish a secure, authenticated communication channel, often used in VPNs to set up secure connections.
UEFI Firmware Flaw Exposes Motherboards to Pre-Boot DMA Attacks
Medium
Executive Summary
A newly discovered vulnerability in the UEFI firmware implementation of motherboards from ASUS, Gigabyte, MSI, and ASRock allows direct memory access (DMA) attacks that can bypass early boot memory protections. This flaw, identified by multiple CVEs, can allow attackers with physical access to read or modify system memory before the OS loads.
Vulnerability Details
Affected Product: Motherboards from ASUS, Gigabyte, MSI, and ASRock. Affected ASRock motherboards use Intel 500, 600, 700, and 800 series chipsets. Affected ASUS motherboards use Intel Z490, W480, B460, H410, Z590, B560, H510, Z690, B660, W680, Z790, B760, and W790 series chipsets. Affected GIGABYTE motherboards use Intel 600-800 and AMD 600-800 series chipsets, including TRX50 platforms. Affected MSI motherboards use Intel 600 and 700 series chipsets.
Triage: High. Apply available firmware updates immediately, especially in environments where physical access is not tightly controlled.
Attack Vector: A malicious PCIe device with physical access can read or modify system memory before the operating system's defenses load. The vulnerability stems from the failure to properly initialize the IOMMU during the early boot phase.
Ease of Exploit: Requires physical access to the system and a malicious PCIe device.
Action Plan
Immediate Action: Update the BIOS/UEFI firmware to the latest version provided by the motherboard vendor. For ASUS and Gigabyte motherboards, manually enable full DMA protection in the BIOS/UEFI setup utility after the update.
Workaround: Avoid using untrusted PCIe expansion devices, especially in uncontrolled physical environments.
Detection: Monitor for unauthorized DMA attempts and anomalous pre-boot behavior.
Relevant professional terms
UEFI (Unified Extensible Firmware Interface)
A modern firmware interface that initializes hardware and starts the operating system during boot, replacing the legacy BIOS. It runs before the OS loads and has high privileges, making it a critical security boundary.
DMA (Direct Memory Access)
A hardware feature that allows devices to read and write directly to RAM without involving the CPU, used to improve performance but can be exploited in DMA attacks.
New Critical WatchGuard Firebox Firewall Flaw Exploited in Attacks
Critical
Executive Summary
WatchGuard has issued a warning regarding a critical remote code execution (RCE) vulnerability, CVE-2025-14733, in its Firebox firewalls, which is being actively exploited in the wild. The vulnerability allows unauthenticated attackers to remotely execute arbitrary code on unpatched devices.
Vulnerability Details
Affected Product: WatchGuard Firebox firewalls running Fireware OS 11.x and later (including 11.12.4_Update1), 12.x or later (including 12.11.5), and 2025.1 up to and including 2025.1.3
Identifier: CVE-2025-14733
CVSS Score: 9.3 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is crucial to prevent potential compromise.
Attack Vector: The vulnerability is due to an out-of-bounds write weakness in the Fireware OS IKEv2 process, allowing remote, unauthenticated attackers to execute arbitrary code.
Ease of Exploit: Exploitation is achieved through low-complexity attacks that don't require user interaction.
Action Plan
Immediate Action: Upgrade to Fireware OS versions 2025.1.4, 12.11.6, 12.5.15, or 12.3.1_Update4 (B728352). Note that there is no fix for 11.x, which is end-of-life.
Workaround: Disable dynamic peer BOVPNs, add new firewall policies, and disable the default system policies that handle VPN traffic.
Detection: Check for outbound traffic to the following IP addresses: 45.95.19[.]50, 51.15.17[.]89, 172.93.107[.]67, 199.247.7[.]82. Also, look for IKE_AUTH request log messages with CERT payload greater than 2,000 bytes or iked process hangs.
Relevant professional terms
Remote Code Execution (RCE)
A vulnerability that allows an attacker to execute arbitrary code on a target system from a remote location.
Out-of-Bounds Write
A type of software vulnerability where the program writes data beyond the allocated buffer, potentially causing a crash or allowing arbitrary code execution.
Russian state-sponsored groups, including Z-Pentest and NoName057(16), targeted Danish critical infrastructure and government websites. The attacks aimed to create insecurity and undermine Western support for Ukraine.
Key TTPs
Initial Access: Exploitation of weak remote access protocols and vulnerabilities in Zyxel firewalls.
Execution: Manipulation of industrial control systems and distributed denial-of-service (DDoS) attacks.
Defense Evasion: Use of virtual private servers (VPSs) to obscure origin.
Campaign Analysis
The attacks are part of a broader hybrid war against the West, intended to punish countries supporting Ukraine and undermine Western support. These operations demonstrate Russia's increasing integration of cyberattacks with broader influence campaigns.
Targeting & Infrastructure
Target Profile: Danish water utilities, government websites, and critical infrastructure.
The Cloud Atlas APT is employing new malicious tools, including implants of their signature backdoors, to target organizations in Eastern Europe and Central Asia. The group aims to conduct cyber-espionage and steal confidential information.
Key TTPs
Initial Access: Spear-phishing emails with malicious attachments.
Execution: Exploitation of Microsoft Office Equation Editor vulnerability (CVE-2018-0802).
Defense Evasion: Polymorphic malware to avoid detection.
Campaign Analysis
Cloud Atlas is enhancing its toolset, adding new capabilities to existing malware. The group continues to target government agencies in Russia and Belarus.
Targeting & Infrastructure
Target Profile: Government entities, military organizations, and financial institutions in Eastern Europe and Central Asia.
Infrastructure: Utilizes cloud services such as Yandex Disk and Google Sheets for C2.
PRO TIP: APT groups spend months building profiles of their targets before sending a single email. If your email address is public, you are an easy target. Complicate their reconnaissance by using unique aliases, effectively making your real inbox invisible.
Relevant Terms
APT: Advanced Persistent Threat, a sophisticated, long-term cyberattack targeting specific entities.
Spear-phishing: A targeted phishing attack that sends customized emails to specific individuals.
The FBI, along with international partners, seized the E-Note cryptocurrency exchange for allegedly laundering over $70 million in illicit funds. The exchange facilitated transactions for ransomware groups and other cybercriminals.
The Scheme
TTP 1: Facilitated the transfer of funds across countries.
TTP 2: Converted cryptocurrency proceeds into fiat currency.
TTP 3: Used a network of "money mules" to obscure the origin of funds.
Outcome: Chudnovets faces a money laundering conspiracy charge with a maximum penalty of 20 years in prison.
Assets Seized/Forfeited:$70 million in illicit proceeds.
Strategic Takeaway
The seizure highlights the ongoing efforts to disrupt financial networks used by cybercriminals to launder money obtained through ransomware and other illicit activities.
Relevant Terms
Money Mule: Individuals who transfer illegally acquired money on behalf of others, often unwittingly.
Fiat Currency: Government-issued currency that is not backed by a physical commodity, such as gold or silver.
