Vulnerability · Published Mar 7, 2023 · Assigned by trendmicro
CVE-2023-25147
Medium 6.7
In plain English
A medium-severity uncontrolled search path in Trend Micro Apex One from Trend Micro, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on the target system via another method in order to exploit this.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Trend Micro, Inc. | Trend Micro Apex One | 2019 (14.0) – before 14.0.0.11564 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H