What is the CVSS score of CVE-2025-30641?

CVE-2025-30641 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Trend Micro are affected by CVE-2025-30641?

Trend Micro Deep Security 20.0 contains a local privilege escalation vulnerability in its anti-malware component that allows attackers with low-privileged access to gain system-level control,…. A patch is available.

How to fix or mitigate CVE-2025-30641?

Within 24 hours: Identify all systems running Trend Micro Deep Security 20.0 using asset inventory and endpoint management tools; prioritize production servers and workstations with sensitive data access. Within 7 days: Apply vendor-released patch to all identified Deep Security 20.0 instances and verify successful deployment via Deep Security console. Within 30 days: Conduct post-patch verification across the environment and review logs for any suspicious privilege escalation attempts on previously vulnerable endpoints.

Trend Micro CVE-2025-30641

EUVD-2025-27793 HIGH

Improper Link Resolution Before File Access (CWE-59)

2025-06-17 security@trendmicro.com

Privilege Escalation Trend Micro Deep Security Agent

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

20.0.1-25770

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-27793

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

HIGH 7.8

DescriptionCVE.org

A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

AnalysisAI

Link following (symlink) vulnerability in Trend Micro Deep Security 20.0 agent's anti-malware component that enables local privilege escalation. An attacker with low-privileged code execution can exploit this to gain elevated system privileges (confidentiality, integrity, and availability impact). While no public exploit or active exploitation in the wild has been confirmed, the CVSS 7.8 score and low attack complexity indicate this poses a significant risk to organizations running vulnerable versions.

Technical ContextAI

This vulnerability exploits CWE-59 (Improper Link Resolution Before File Access, aka 'Link Following'), a classic privilege escalation flaw where a privileged process follows attacker-controlled symbolic links or hard links without proper validation. In Trend Micro Deep Security's anti-malware engine, the affected code likely performs file operations (scanning, logging, or remediation actions) with elevated privileges while failing to verify that file paths have not been redirected via symlinks to sensitive system locations (/etc/sudoers, /root/.ssh, kernel modules, etc.). The vulnerability is specific to Trend Micro Deep Security version 20.0 agents, which are typically installed with system/root privileges. The anti-malware module's file handling during scan operations or threat remediation is the likely attack surface. CPE identifier would be: cpe:2.3:a:trendmicro:deep_security:20.0:*:*:*:*:*:*:*

RemediationAI

Immediate remediation: (1) Apply the latest Trend Micro Deep Security Agent patch beyond version 20.0; Trend Micro typically releases patches in the 20.0.x.x sequence or recommends upgrading to version 21.x or later. Check the official Trend Micro Deep Security release notes and security advisory portal for specific patched versions. (2) Interim mitigation: Restrict local user account privileges and limit code execution contexts for untrusted users on systems running Deep Security 20.0. Implement file system access controls to prevent unprivileged users from creating symlinks in directories where the Deep Security agent writes logs or temporary files (typically /var/log, /tmp, /var/tmp on Linux). (3) Monitor: Enable audit logging for symlink creation and privilege escalation attempts. (4) Vendor advisory: Review Trend Micro's official CVE-2025-30641 advisory for patch download links and validation checksums.