EUVD-2025-18531CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Lifecycle Timeline
3Tags
Description
An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Analysis
CVE-2025-49154 is an insecure access control vulnerability (CWE-284) in Trend Micro Apex One and Worry-Free Business Security that allows a local attacker with low-privileged code execution to overwrite critical memory-mapped files, potentially compromising system security and stability. With a CVSS score of 8.7 and low attack complexity, this vulnerability poses a significant risk to enterprise security postures, though exploitation requires prior code execution access. No active KEV confirmation or public POC availability is documented in standard vulnerability databases at this time.
Technical Context
This vulnerability stems from improper access control mechanisms protecting memory-mapped files used by Trend Micro's endpoint security solutions. Memory-mapped files are a Windows mechanism where file contents are mapped directly into process address space, often used for inter-process communication and shared data access. CWE-284 (Improper Access Control - Permissions, Privileges, and Other Access Controls) indicates that Trend Micro Apex One and Worry-Free Business Security fail to properly restrict write access to these critical security-sensitive files. The affected technology involves kernel-level or privileged service components that should restrict file modification to authenticated, high-privileged contexts but instead allow low-privileged local processes to modify them. This likely affects security decision-making files, configuration stores, or threat intelligence caches that the security software relies upon for protection mechanisms.
Affected Products
Trend Micro Apex One (all versions prior to patched release, likely CPE: cpe:2.3:a:trendmicro:apex_one:*:*:*:*:*:*:*:*) and Trend Micro Worry-Free Business Security (all versions prior to patched release, likely CPE: cpe:2.3:a:trendmicro:worry_free_business_security:*:*:*:*:*:*:*:*). Both products are enterprise-grade endpoint protection solutions used in Windows-based environments. Specific version numbers affected should be cross-referenced with Trend Micro's official security advisory (TMSA or bulletin), which typically provides exact version cutoffs and patch availability. The vulnerability affects installations on Windows systems where the vulnerable code paths are present.
Remediation
Patch Management: Apply the latest security updates from Trend Micro for both Apex One and Worry-Free Business Security as released in their official security advisories. Consult Trend Micro's security bulletin portal for specific patch versions and release dates. Workarounds: (1) Restrict local code execution privileges using Windows AppLocker, Software Restriction Policies, or third-party endpoint application control to prevent low-privileged attackers from executing arbitrary code; (2) Run user applications in sandboxed or containerized environments; (3) Implement strict principle-of-least-privilege for user accounts. Monitoring: Enable audit logging on file access to memory-mapped security files and monitor for unauthorized modification attempts. Post-remediation verification should confirm that file permissions on critical Trend Micro-managed files (typically in C:\Program Files\Trend Micro\ or AppData directories) are properly restricted.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today