EUVD-2025-27792CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
AnalysisAI
Link following vulnerability (symlink attack) in Trend Micro Deep Security 20.0 agents that enables local privilege escalation on affected systems. An attacker with low-privileged code execution capability can exploit this flaw to gain high-level system access. The vulnerability has a CVSS score of 7.8 with high impact across confidentiality, integrity, and availability; KEV and POC status are not confirmed in available data, but the low attack complexity and low privilege requirement indicate moderate real-world risk once initial code execution is obtained.
Technical ContextAI
This vulnerability stems from CWE-59 (Improper Link Resolution Before File Access), a classic link-following or symlink attack. The Deep Security agent likely fails to properly validate or resolve symbolic links before performing file operations with elevated privileges. When the agent accesses files or directories as root/SYSTEM, an unprivileged user can create malicious symlinks pointing to sensitive system files or directories. The agent then follows these links and modifies targets that the attacker could not directly access, achieving privilege escalation. This typically occurs in temporary directories, cache locations, or log file handling where agents write or read files without proper link validation. Affected: Trend Micro Deep Security agents version 20.0; CPE context would be cpe:2.3:a:trendmicro:deep_security_agent:20.0:*:*:*:*:*:*:* and related variants.
Share
External POC / Exploit Code
Leaving vuln.today