CVE-2023-52094: Trend Micro Apex One Security Agent Updater Link Following Local Privilege Escalation Vulnerability
An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbitrary folder, leading for a local privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product update mechanism. By creating a junction, an attacker can abuse the updater to delete a folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52094?
CVE-2023-52094 is classified as a local privilege escalation vulnerability.
How do I fix CVE-2023-52094?
To remediate CVE-2023-52094, update your Trend Micro Apex One software to the latest version as recommended by the vendor.
What type of vulnerability is CVE-2023-52094?
CVE-2023-52094 is an updater link following vulnerability that allows local attackers to delete arbitrary folders.
Who is affected by CVE-2023-52094?
CVE-2023-52094 affects installations of Trend Micro Apex One, specifically versions prior to 14.0.12849 and the 2019 edition.
Can CVE-2023-52094 be exploited remotely?
No, CVE-2023-52094 requires local access to exploit the vulnerability.