CVE-2023-32554: Trend Micro Apex One Security Agent Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32555.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One Client Plug-in Service Manager. The issue results from the lack of proper locking when performing operations on a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-32554?
CVE-2023-32554 is a vulnerability that allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent.
How can an attacker exploit CVE-2023-32554?
An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
What software versions are affected by CVE-2023-32554?
Trend Micro Apex One versions up to and excluding 14.0.12105 are affected, as well as Trend Micro Apex One 2019.
What is the severity of CVE-2023-32554?
The severity of CVE-2023-32554 is rated as high with a CVSS score of 7.8.
How can I fix CVE-2023-32554?
To fix this vulnerability, update to a version of Trend Micro Apex One that is not affected by the issue.