CVE-2023-32555: Trend Micro Apex One Security Agent Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32554.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One Client Plug-in Service Manager. The issue results from the lack of proper locking when performing operations on a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-32555?
CVE-2023-32555 is a vulnerability that allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent.
How does CVE-2023-32555 work?
CVE-2023-32555 exists within the Trend Micro Apex One Security Agent and can be exploited by local attackers who have the ability to execute low-privileged code on the target system.
What is the severity of CVE-2023-32555?
CVE-2023-32555 has a severity score of 7.8 (high).
Which software versions are affected by CVE-2023-32555?
CVE-2023-32555 affects Trend Micro Apex One versions up to and excluding 14.0.12105 and 2019.
How can I fix CVE-2023-32555?
To fix CVE-2023-32555, it is recommended to update to a patched version of Trend Micro Apex One Security Agent.