CVE-2023-52090: Trend Micro Apex One Virus Scan Engine Link Following Local Privilege Escalation Vulnerability
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Virus Scan Engine. By creating a mount point, an attacker can abuse the VSApiNt driver to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52090?
CVE-2023-52090 has been classified as a high severity vulnerability due to its privilege escalation potential.
How do I fix CVE-2023-52090?
To mitigate CVE-2023-52090, ensure that you update Trend Micro Apex One to the latest version and apply any available security patches.
Which versions of Trend Micro Apex One are affected by CVE-2023-52090?
CVE-2023-52090 affects Trend Micro Apex One versions before 14.0.12849 and the 2019 version.
Can CVE-2023-52090 be exploited remotely?
No, CVE-2023-52090 requires local access to the system for exploitation.
What type of attack is possible with CVE-2023-52090?
CVE-2023-52090 allows local attackers to escalate privileges, potentially gaining higher access on the system.