Trend Micro CVE-2025-49154

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates: Local attack vector (requires system access), Low complexity (no special conditions needed), Low privilege requirement (standard user), No user interaction needed, and Changed scope (impacts beyond the vulnerable component). The 8.7 base score reflects High integrity and availability impact, with Low confidentiality impact. While the score is elevated, real-world exploitation is constrained by the prerequisite that attackers must first achieve low-privileged code execution on the target system. This significantly limits the threat model compared to remote or unauthenticated attacks. Without confirmed EPSS score, active KEV status, or public POC availability, this should be prioritized as HIGH for environments where users run untrusted code or where supply-chain/third-party application compromises are plausible, but MEDIUM for organizations with strict application whitelisting and code execution controls. The changed scope (S:C) is particularly concerning, as file overwriting could affect system-wide security posture beyond the security software itself.

An attacker gains initial code execution on a corporate workstation through a compromised third-party application, malicious email attachment, or supply-chain compromise. The attacker's code runs under the standard user context (satisfying the PR:L requirement). The attacker identifies and overwrites a memory-mapped configuration or threat intelligence file used by Trend Micro Apex One—for example, a signature database or security policy file. This modification causes the security software to disable critical protections (e.g., exploit guard, behavioral analysis) or whitelist malicious processes. Consequently, subsequent malware execution on the system evades detection, allowing the attacker to establish persistence, exfiltrate data, or move laterally within the enterprise network. The scope change (S:C) means the impact extends beyond the security product to the entire system's security posture. The low attack complexity (AC:L) means no special techniques or race conditions are required—straightforward file overwrite operations suffice, making the attack highly reliable once code execution is achieved.