ZDI-25-360: Trend Micro Worry-Free Business Security Uncontrolled Search Path Element Arbitrary Code Execution Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Trend Micro Worry-Free Business Security. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The process loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
Other sources
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Trend Micro Worry-Free Business Security. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2025-49487.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-360?
The severity of ZDI-25-360 is considered critical due to the potential for arbitrary code execution without authentication.
How do I fix ZDI-25-360?
To fix ZDI-25-360, update Trend Micro Worry-Free Business Security to the latest version that includes the necessary patches.
Who is affected by ZDI-25-360?
ZDI-25-360 affects installations of Trend Micro Worry-Free Business Security that have not applied the latest security updates.
Can ZDI-25-360 be exploited remotely?
No, ZDI-25-360 requires physical access to exploit the vulnerability.
What is the underlying cause of ZDI-25-360?
The underlying cause of ZDI-25-360 is a configuration flaw within OpenSSL that allows code execution.