CVE-2023-47192: Trend Micro Apex One Security Agent Link Following Local Privilege Escalation Vulnerability
An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One NT RealTime Scan service. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-47192?
CVE-2023-47192 is classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2023-47192?
To fix CVE-2023-47192, update the Trend Micro Apex One software to the latest version as specified in the official vendor advisory.
Who is affected by CVE-2023-47192?
CVE-2023-47192 affects installations of Trend Micro Apex One, particularly versions up to 14.0.12737 and the 2019 version.
What type of vulnerability is CVE-2023-47192?
CVE-2023-47192 is identified as an agent link vulnerability that allows a local attacker to escalate privileges.
Does CVE-2023-47192 require remote access to exploit?
No, CVE-2023-47192 requires an attacker to have the ability to execute low-privileged code on the target system before exploiting it.