CVE-2025-49217: Trend Micro Endpoint Encryption ValidateToken Deserialization of Untrusted Data Remote Code Execution Vulnerability
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Endpoint Encryption. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the ValidateToken method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49217?
CVE-2025-49217 is considered to be a critical vulnerability due to the potential for pre-authentication remote code execution.
How do I fix CVE-2025-49217?
To mitigate CVE-2025-49217, users should update their Trend Micro Endpoint Encryption software to the latest version provided by the vendor.
What type of vulnerability is CVE-2025-49217?
CVE-2025-49217 is classified as an insecure deserialization vulnerability.
Which software is affected by CVE-2025-49217?
CVE-2025-49217 affects Trend Micro Endpoint Encryption installations.
Can CVE-2025-49217 lead to data breaches?
Yes, CVE-2025-49217 can potentially allow attackers to execute arbitrary code, which may lead to data breaches.