CVE-2022-40710: Trend Micro Deep Security Link Following Local Privilege Escalation Vulnerability

Published Sep 28, 2022

Updated

A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Affected Software

38 affected components

trendmicro Deep Security=20.0

All of the following

Any of the following

trendmicro Deep Security Agent=20.0

trendmicro Deep Security Agent=20.0-update1337

trendmicro Deep Security Agent=20.0-update1559

trendmicro Deep Security Agent=20.0-update158

trendmicro Deep Security Agent=20.0-update167

trendmicro Deep Security Agent=20.0-update1681

trendmicro Deep Security Agent=20.0-update173

trendmicro Deep Security Agent=20.0-update180

trendmicro Deep Security Agent=20.0-update182

trendmicro Deep Security Agent=20.0-update1822

trendmicro Deep Security Agent=20.0-update183

trendmicro Deep Security Agent=20.0-update1876

trendmicro Deep Security Agent=20.0-update190

trendmicro Deep Security Agent=20.0-update198

trendmicro Deep Security Agent=20.0-update2009

trendmicro Deep Security Agent=20.0-update208

trendmicro Deep Security Agent=20.0-update213

trendmicro Deep Security Agent=20.0-update2204

trendmicro Deep Security Agent=20.0-update223

trendmicro Deep Security Agent=20.0-update224

trendmicro Deep Security Agent=20.0-update2419

trendmicro Deep Security Agent=20.0-update2593

trendmicro Deep Security Agent=20.0-update2740

trendmicro Deep Security Agent=20.0-update2921

trendmicro Deep Security Agent=20.0-update3165

trendmicro Deep Security Agent=20.0-update3288

trendmicro Deep Security Agent=20.0-update3445

trendmicro Deep Security Agent=20.0-update3530

trendmicro Deep Security Agent=20.0-update3771

trendmicro Deep Security Agent=20.0-update3964

trendmicro Deep Security Agent=20.0-update4185

trendmicro Deep Security Agent=20.0-update4416

trendmicro Deep Security Agent=20.0-update4726

trendmicro Deep Security Agent=20.0-update4959

trendmicro Deep Security Agent=20.0-update5137

trendmicro Deep Security Agent=20.0-update877

Microsoft Windows

Event History

Sep 28, 2022

CVE Published

via MITRE·09:10 PM

Data Sourced

via MITRE·09:10 PM

DescriptionWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Jun 29, 2026

Advisory Published

via ZDI·05:46 AM

Data Sourced

via ZDI·05:46 AM

DescriptionAffected Software

Frequently Asked Questions

What is CVE-2022-40710?

CVE-2022-40710 is a vulnerability in Trend Micro Deep Security that allows local attackers to escalate privileges on affected installations.

How severe is CVE-2022-40710?

CVE-2022-40710 has a severity rating of 7.8 (high).

What is the affected software?

The affected software is Trend Micro Deep Security version 20.0 (long-term support).

How can this vulnerability be exploited?

To exploit CVE-2022-40710, an attacker must first obtain the ability to execute low-privileged code on the target system.

Is there a fix available for CVE-2022-40710?

Yes, it is recommended to update to the latest version of Trend Micro Deep Security to mitigate this vulnerability.

CVE-2022-40710: Trend Micro Deep Security Link Following Local Privilege Escalation Vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2022-40710?

How severe is CVE-2022-40710?

What is the affected software?

How can this vulnerability be exploited?

Is there a fix available for CVE-2022-40710?

Company

Resources

Contact