Trend Micro CVE-2025-30640

CVSS 7.8 (High) reflects the severity: local attack vector (AV:L), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and high impact (C:H, I:H, A:H). However, the prerequisite of obtaining low-privileged code execution on the target system is a significant gating factor—this is not a vulnerability an attacker can exploit remotely or without initial compromise. The attack complexity is low, meaning once an attacker has a foothold, exploitation is straightforward. Without confirmed EPSS data or KEV/active exploitation reports in the provided information, the real-world risk is moderate to high for environments where insider threats, supply chain compromises, or multi-stage attacks are concerns. Organizations with strong access controls limiting unprivileged user presence will see lower risk; those running Deep Security 20.0 on systems with high user churn or shared access should prioritize patching.

An attacker gains low-privileged shell access to a Linux server running Deep Security Agent 20.0 (e.g., via a compromised web application or SSH account). The agent runs periodic file operations (log rotation, cache cleanup, configuration validation) with root privileges. The attacker creates a symlink in /tmp pointing from a filename the agent expects to write to (e.g., /tmp/ds_update.tmp) to a sensitive system file (e.g., /etc/sudoers or /etc/passwd). When the Deep Security agent processes the file without validating the symlink, it writes to or modifies the target file via the link. The attacker then modifies the symlink target to point to another file or executes commands with the elevated permissions the agent granted. Result: privilege escalation from unprivileged user to root. No confirmed POC is noted in available data, but symlink attack techniques are well-documented and automatable, making exploitation feasible for moderately skilled threat actors with initial code execution.