CVE-2022-33158: Trend Micro Proxy One Pro Incorrect Permission Assignment Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Proxy One Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions set on a directory. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Other sources
Trend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some overly permissive folders in a key directory which could allow a local attacker to obtain privilege escalation on an affected system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-33158?
CVE-2022-33158 has a CVSS score indicating a high severity due to its potential for privilege escalation by local attackers.
How do I fix CVE-2022-33158?
To fix CVE-2022-33158, it is recommended to update Trend Micro Proxy One Pro to the latest version available.
Who is affected by CVE-2022-33158?
CVE-2022-33158 affects users of Trend Micro Proxy One Pro versions up to and including 5.2.1026.
What type of attack is associated with CVE-2022-33158?
CVE-2022-33158 is associated with local privilege escalation attacks on affected systems.
What must an attacker do to exploit CVE-2022-33158?
To exploit CVE-2022-33158, an attacker must first have the ability to execute low-privileged code on the target system.