CVE-2023-34144
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
CVE-2023-34144 describes an untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent that could allow a local attacker to escalate their privileges on affected installations.
Risk Assessment
An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability, which increases the risk of privilege escalation.
Recommendation
It is recommended to monitor and restrict access to systems to prevent the execution of low-privileged code, as well as to update the software to the latest version to minimize risk.
Other vulnerabilities in Trend Micro Apex One, Trend Micro Apex One as a Service
See all- CVE-2023-34148High
A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
- CVE-2023-34147High
A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
- CVE-2023-34146High
A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
- CVE-2023-34145High
A vulnerability in Trend Micro Apex One and Apex One as a Service due to an untrusted search path could allow a local attacker to escalate their privileges on affected installations.
Original NVD description (English source)
An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34145.