CVE-2023-34146
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
Risk Assessment
An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability, which increases the risk of privilege escalation within the organization.
Recommendation
It is recommended to monitor and restrict access to systems to prevent the execution of low-privileged code and to update the software to the latest version to mitigate this vulnerability.
Other vulnerabilities in Trend Micro Apex One, Trend Micro Apex One as a Service
See all- CVE-2023-34148High
A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
- CVE-2023-34147High
A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
- CVE-2023-34145High
A vulnerability in Trend Micro Apex One and Apex One as a Service due to an untrusted search path could allow a local attacker to escalate their privileges on affected installations.
- CVE-2023-34144High
CVE-2023-34144 describes an untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent that could allow a local attacker to escalate their privileges on affected installations.
Original NVD description (English source)
An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34147 and CVE-2023-34148.