CVE-2024-32849: Trend Micro Maximum Security coreServiceShell Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Maximum Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the coreServiceShell. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Other sources
Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32849?
CVE-2024-32849 has a medium severity rating that allows for local privilege escalation.
How do I fix CVE-2024-32849?
To remediate CVE-2024-32849, ensure that you apply the latest security patches provided by Trend Micro for Maximum Security.
What does CVE-2024-32849 affect?
CVE-2024-32849 affects installations of Trend Micro Maximum Security, specifically the 2022 version.
Who can exploit CVE-2024-32849?
CVE-2024-32849 can be exploited by local attackers who have the ability to execute low-privileged code on the system.
What type of vulnerability is CVE-2024-32849?
CVE-2024-32849 is classified as a local privilege escalation vulnerability.