CVE-2023-25147
Last modified
CVE-2023-25147 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on the target system via another method in order to exploit this.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on the target system via another method in order to exploit this.
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Trendmicro | Apex One | < 14.0.11960 |
| Trendmicro | Apex One | 2019 |
References
- https://success.trendmicro.com/solution/000292209Vendor Advisory
- https://success.trendmicro.com/solution/000292209Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-25147?
How severe is CVE-2023-25147?
How do I fix CVE-2023-25147?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-25140A vulnerability has been identified in Parasolid V34.0 (All …7.8
- CVE-2023-25141Apache Sling JCR Base < 3.1.12 has a critical injection vuln…7.5
- CVE-2023-25143An uncontrolled search path element vulnerability in the Tre…9.8
- CVE-2023-25144An improper access control vulnerability in the Trend Micro …7.8
- CVE-2023-25145A link following vulnerability in the scanning function of T…7.8
- CVE-2023-25146A security agent link following vulnerability in the Trend M…7.8
- CVE-2023-25148A security agent link following vulnerability in Trend Micro…7.8
- CVE-2023-25149TimescaleDB, an open-source time-series SQL database, has a …8.8
- CVE-2023-2515Mattermost fails to restrict a user with permissions to edit…8.8
- CVE-2023-25150Nextcloud office/richdocuments is an office suit for the nex…5.7
- CVE-2023-25151opentelemetry-go-contrib is a collection of extensions for O…7.5
- CVE-2023-25152Wings is Pterodactyl's server control plane. Affected versio…8.8
Are you affected by CVE-2023-25147?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST