ZDI-CAN-23056: ZDI-25-360: Trend Micro Worry-Free Business Security Uncontrolled Search Path Element Arbitrary Code Execution Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Trend Micro Worry-Free Business Security. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The process loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
Other sources
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Trend Micro Worry-Free Business Security. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2025-49487.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23056?
The severity of ZDI-CAN-23056 is critical due to its potential for arbitrary code execution without authentication.
How can I fix ZDI-CAN-23056?
To fix ZDI-CAN-23056, update to the latest version of Trend Micro Worry-Free Business Security as per the vendor's advisory.
Who is affected by ZDI-CAN-23056?
ZDI-CAN-23056 affects installations of Trend Micro Worry-Free Business Security that are poorly configured.
Can ZDI-CAN-23056 be exploited remotely?
No, ZDI-CAN-23056 requires physical access to the affected system to exploit.
What are the implications of ZDI-CAN-23056?
The implications of ZDI-CAN-23056 include the risk of unauthorized code execution, leading to potential data breaches or system compromise.