CVE-2023-34148
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
Risk Assessment
An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability, increasing the risk of privilege escalation within the organization.
Recommendation
It is recommended to monitor and restrict access to systems, as well as to update Trend Micro software to patch this vulnerability.
Other vulnerabilities in Trend Micro Apex One, Trend Micro Apex One as a Service
See all- CVE-2023-34147High
A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
- CVE-2023-34146High
A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
- CVE-2023-34145High
A vulnerability in Trend Micro Apex One and Apex One as a Service due to an untrusted search path could allow a local attacker to escalate their privileges on affected installations.
- CVE-2023-34144High
CVE-2023-34144 describes an untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent that could allow a local attacker to escalate their privileges on affected installations.
Original NVD description (English source)
An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34146 and CVE-2023-34147.