CVE-2024-41183: Trend Micro VPN Proxy One Pro Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro VPN Proxy One Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DEP Manager. By creating a symbolic link, an attacker can abuse the service to delete a folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro VPN Proxy One Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the VpnBackgroundController executable. By creating a symbolic link, an attacker can abuse the application to move arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
— ZDI
Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevation of privileges.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41183?
CVE-2024-41183 has been assessed as a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-41183?
To fix CVE-2024-41183, ensure that you update Trend Micro VPN Proxy One Pro to the latest version that addresses this vulnerability.
Who is vulnerable to CVE-2024-41183?
Organizations using vulnerable installations of Trend Micro VPN Proxy One Pro are at risk of CVE-2024-41183.
What type of attack does CVE-2024-41183 facilitate?
CVE-2024-41183 facilitates local privilege escalation attacks, allowing low-privileged users to gain higher privileges.
Is remote access required to exploit CVE-2024-41183?
No, CVE-2024-41183 requires local access to the system to execute low-privileged code for exploitation.