CVE-2023-34147: An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to ...

Summary

An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.

Please note: an attacker must first ob...

What to do

Update trendmicro apex_one to version 14.0.12518 or later.

Affected software

Vendor	Product	Affected versions
trendmicro	apex_one	< 14.0.12518 2019 `cpe:2.3:a:trendmicro:apex_one:::::saas:::*`

Original advisory text

An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to ...

An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is a similar, but not identical vulnerability as CVE-2023-34146 and CVE-2023-34148.

References

https://success.trendmicro.com/dcx/s/solution/000293322?language=en_US Patch Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-833/ Third Party Advisory VDB Entry