Trend Micro CVE-2025-49156

Risk Assessment Analysis: The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates: Attack Vector Local (AV:L) - requires local system access; Attack Complexity High (AC:H) - exploitation requires special conditions or significant effort; Privileges Required Low (PR:L) - attacker needs low-privileged account; User Interaction None (UI:N) - no user action required; Scope Unchanged (S:U) - impact limited to the vulnerable component; Confidentiality/Integrity/Availability High (C:H/I:H/A:H) - complete compromise possible. The CVSS score of 7.0 reflects moderate-to-high severity, but the AC:H and PR:L requirements significantly reduce real-world exploitability compared to remote unauthenticated attacks. Without KEV (Known Exploited Vulnerability) status confirmation, active POC code, or elevated EPSS score data, this represents a targeted local privilege escalation threat primarily relevant to multi-user systems or scenarios where attackers have already achieved initial code execution. Organizations should prioritize patching in environments where endpoint security is critical and where local code execution is a realistic threat model.

An attacker with low-privileged local access (e.g., standard user account) on a Windows or Linux system running Trend Micro Apex One creates a symbolic link or hard link in a directory where the scan engine performs operations (e.g., temporary scan directories, cache locations, or quarantine folders). When the Apex One scan engine processes files in this directory with elevated privileges (SYSTEM/root), it follows the attacker-controlled link without proper validation, dereferencing it to a sensitive file or directory (e.g., system configuration file, privileged process memory, or security policy database). The attacker then exploits this to read sensitive data, modify system configuration, inject malicious code into a privileged process, or execute arbitrary commands with elevated privileges. The AC:H rating suggests the attacker must satisfy specific conditions, such as timing the link creation to coincide with a scan operation or placing the link in a location with predictable scan behavior. No POC code is referenced in the available data, suggesting either responsible disclosure practices or early vulnerability discovery.