ASUS Live Update Client Supply Chain Compromise Vulnerability

A vulnerability exists in certain versions of the ASUS Live Update client for notebooks, due to unauthorized modifications introduced through a supply chain compromise. This vulnerability affects devices that installed the compromised versions and met specific targeting conditions, allowing them to perform unintended actions. The Live Update client has reached End-of-Support in October 2021, and no currently supported devices are affected.

Impact

The vulnerability could allow compromised devices to perform unintended actions, potentially leading to unauthorized access or manipulation of system functions.

Remediation

ASUS has released a fixed version of the Live Update client (version 3.6.8) that addresses the vulnerability by introducing security verification mechanisms, enhancing encryption, and updating the software architecture to prevent similar attacks. Affected users are advised to restore their operating systems to factory settings and contact ASUS Customer Service for assistance.