CVE-2025-49213: Trend Micro Endpoint Encryption PolicyServerWindowsService Deserialization of Untrusted Data Remote Code Execution Vulnerability
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Endpoint Encryption. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PolicyServerWindowsService class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49213?
CVE-2025-49213 is classified as critical due to its potential for pre-authentication remote code execution.
How do I fix CVE-2025-49213?
To address CVE-2025-49213, apply the latest security patches provided by Trend Micro for the Endpoint Encryption software.
What versions of Trend Micro Endpoint Encryption are impacted by CVE-2025-49213?
CVE-2025-49213 affects specific, unpatched versions of Trend Micro Endpoint Encryption; users should consult with their vendor documentation for details.
What are the potential risks associated with CVE-2025-49213?
The risks of CVE-2025-49213 include unauthorized access and control over affected systems due to remote code execution.
Is there any workaround for CVE-2025-49213 until a patch is applied?
Currently, there are no official workarounds for CVE-2025-49213, so immediate patching is recommended to mitigate risks.