Trend Micro Zero-day Vulnerability Let Attackers Run Arbitrary Code

If you use Trend Micro Apex One, you should know that the third-party Antivirus uninstaller feature may have a security hole. This flaw could make it possible for random code to be run.

Even though the National Vulnerability Database (NVD) hasn’t proven how bad the problem is yet, you should be careful and take the right steps to protect your system.

But it was also found that this security hole is being used in the real world (ITW). “Trend Micro has seen at least one ongoing attempt in the wild (ITW) to take advantage of this vulnerability. Customers are strongly urged to update as soon as possible.” Trend Micro’s post is read.

Trend Micro has put out a security warning about how to fix this problem. Worry-Free Business Security (WFBS) and Worry-Free Business Security Services (WFBSS) are also vulnerable because of this flaw.

CVE-2023-41179 – Arbitrary Code Execution Vulnerability

Threat actors can use this hole to send orders to endpoints that are vulnerable. For an attacker to take advantage of this flaw, they must have access to the administrative console on the target machine.

If the exploit works, the attacker may be able to run commands on the PC where the security agent is installed with system rights. Trend Micro has given this vulnerability a score of 9.1 (Critical) for how bad it is.

Affected Products & Fixed in Versions

ProductAffected Version(s)PlatformFixed in Version*Notes
Apex One2019 (On-prem)WindowsSP1 Patch 1 (B12380)Readme
Apex One as a ServiceSaaSWindowsJuly 2023 Monthly Patch (202307)Agent Version: 14.0.12637Readme
Worry-Free Business Security(WFBS)10.0 SP1Windows10.0 SP1 Patch 2495Readme
Worry-Free Business Security Services(WFBSS)SaaSWindowsJuly 31, 2023Monthly Maintenance Release

Users of these products should change to the most recent version of these products so that threat actors don’t take advantage of this vulnerability.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Guru baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN. This flaw, identified as CVE-2024-40764, can…

59 mins ago

Hackers Registered 500k+ Domains Using Algorithms For Extensive Cyber Attack

Hackers often register new domains for phishing attacks, spreading malware, and other deceitful activities.  Such domains are capable of pretending…

2 hours ago

Hackers Claim Breach of Daikin: 40 GB of Confidential Data Exposed

Daikin, the world's largest air conditioner manufacturer, has become the latest target of the notorious Meow hacking group. The USA…

3 hours ago

Emojis Are To Express Emotions, But CyberCriminals For Attacks

There are 3,664 emojis that can be used to express emotions, ideas, or objects in digital communication. While seemingly harmless,…

3 hours ago

Beware Of Fake Browser Updates That Installs Malicious BOINC Infrastructre

SocGholish malware, also known as FakeUpdates, has exhibited new behavior since July 4th, 2024, as the infection chain still begins…

4 hours ago

Data Breach Increases by Over 1,000% Annually

The Identity Theft Resource Center® (ITRC), a nationally recognized nonprofit organization established to support identity crime victims, released its U.S.…

4 hours ago