If you use Trend Micro Apex One, you should know that the third-party Antivirus uninstaller feature may have a security hole. This flaw could make it possible for random code to be run.
Even though the National Vulnerability Database (NVD) hasn’t proven how bad the problem is yet, you should be careful and take the right steps to protect your system.
But it was also found that this security hole is being used in the real world (ITW). “Trend Micro has seen at least one ongoing attempt in the wild (ITW) to take advantage of this vulnerability. Customers are strongly urged to update as soon as possible.” Trend Micro’s post is read.
Trend Micro has put out a security warning about how to fix this problem. Worry-Free Business Security (WFBS) and Worry-Free Business Security Services (WFBSS) are also vulnerable because of this flaw.
Threat actors can use this hole to send orders to endpoints that are vulnerable. For an attacker to take advantage of this flaw, they must have access to the administrative console on the target machine.
If the exploit works, the attacker may be able to run commands on the PC where the security agent is installed with system rights. Trend Micro has given this vulnerability a score of 9.1 (Critical) for how bad it is.
| Product | Affected Version(s) | Platform | Fixed in Version* | Notes |
| Apex One | 2019 (On-prem) | Windows | SP1 Patch 1 (B12380) | Readme |
| Apex One as a Service | SaaS | Windows | July 2023 Monthly Patch (202307)Agent Version: 14.0.12637 | Readme |
| Worry-Free Business Security(WFBS) | 10.0 SP1 | Windows | 10.0 SP1 Patch 2495 | Readme |
| Worry-Free Business Security Services(WFBSS) | SaaS | Windows | July 31, 2023Monthly Maintenance Release |
Users of these products should change to the most recent version of these products so that threat actors don’t take advantage of this vulnerability.
Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.
A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…
Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…
An investigation revealed an intrusion in Asia involving the BellaCiao .NET malware, as the initial…
A seemingly benign health app, "BMI CalculationVsn," was found on the Amazon App Store, which…
The Lazarus Group has recently employed a sophisticated attack, dubbed "Operation DreamJob," to target employees…
NodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets…