CVE-2023-41179
HighActively exploited (CISA KEV)
Description
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Trend Micro Apex One and Worry-Free Business Security
PublishedSep 19, 2023
First seenSep 19, 2023
Added to KEVSep 21, 2023
Weakness typeCWE-94Code injection
How to fix
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Oct 12, 2023Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trendmicro apex_one | 2019 | — |
| trendmicro worry-free_business_security | 10.0 | — |
| trendmicro worry-free_business_security_services | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.