CVE-2023-25147
First published: Tue Mar 07 2023(Updated: )
An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection by using a specifically crafted DLL during a specific update process. Please note: an attacker must first obtain administrative access on the target system via another method in order to exploit this.
Credit: security@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trendmicro Apex One | <14.0.11960 | |
| Trendmicro Apex One | =2019 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-25147?
CVE-2023-25147 is a vulnerability in the Trend Micro Apex One agent that allows an attacker with admin access to bypass protection using a specially crafted DLL during a specific update process.
How can an attacker exploit CVE-2023-25147?
To exploit CVE-2023-25147, an attacker must first obtain administrative access on the target system and then use a malicious DLL during a specific update process.
What software versions are affected by CVE-2023-25147?
CVE-2023-25147 affects Trend Micro Apex One versions up to and excluding 14.0.11960, as well as Trend Micro Apex One 2019.
What is the severity of CVE-2023-25147?
CVE-2023-25147 has a severity rating of 6.7 (medium).
Is Microsoft Windows affected by CVE-2023-25147?
No, Microsoft Windows is not vulnerable to CVE-2023-25147.
How do I fix CVE-2023-25147?
To fix CVE-2023-25147, update to a version of Trend Micro Apex One that is not affected by the vulnerability.
Where can I find more information about CVE-2023-25147?
You can find more information about CVE-2023-25147 at the following link: [https://success.trendmicro.com/solution/000292209](https://success.trendmicro.com/solution/000292209)
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-25147?
CVE-2023-25147 is associated with CWE-427 (Uncontrolled Search Path Element).
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/tags
- agent/description
- agent/softwarecombine
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/trendmicro
- canonical/trendmicro apex one
- version/trendmicro apex one/2019
- vendor/microsoft
- canonical/microsoft windows