What is the CVSS score of CVE-2025-49215?

CVE-2025-49215 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Trend Micro are affected by CVE-2025-49215?

Trend Micro Endpoint Encryption PolicyServer contains a post-authentication SQL injection vulnerability (CVSS 8.8) that allows attackers with low-privileged system access to escalate to…. A patch is available.

How to fix or mitigate CVE-2025-49215?

Within 24 hours: Identify all Trend Micro Endpoint Encryption PolicyServer instances in your environment and document current versions. Within 7 days: Apply the vendor-released patch to all PolicyServer systems; consult Trend Micro advisory for exact target version numbers and deployment sequence. Within 30 days: Conduct privilege access reviews on affected PolicyServer systems to identify and remediate any unauthorized administrative access; implement network segmentation to restrict low-privileged code execution pathways to PolicyServer hosts.

Trend Micro CVE-2025-49215

EUVD-2025-28285 HIGH

Use of Inherently Dangerous Function (CWE-242)

2025-06-17 security@trendmicro.com

SQLi Trend Micro Privilege Escalation Trend Micro Endpoint Encryption

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.0.0.4013

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28285

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

HIGH 8.8

DescriptionCVE.org

A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.

AnalysisAI

Post-authentication SQL injection vulnerability in Trend Micro Endpoint Encryption PolicyServer that enables authenticated attackers to escalate privileges and achieve full system compromise (confidentiality, integrity, and availability impact). The vulnerability requires an attacker to first obtain low-privileged code execution on the target system before exploiting the SQL injection to escalate to administrative privileges. With a CVSS score of 8.8 and network accessibility, this represents a significant risk to organizations running vulnerable PolicyServer instances, particularly in environments where initial compromise vectors (phishing, lateral movement, supply chain) are plausible.

Technical ContextAI

The vulnerability exists in the Trend Micro Endpoint Encryption PolicyServer's handling of SQL queries, which fails to properly sanitize user-supplied input in post-authentication contexts. This represents a classic SQL injection flaw (CWE-242, also known as CWE-89 Use of Insufficiently Trusted Source in SQL Command) where an authenticated user with low privileges can manipulate SQL logic to bypass authorization controls or extract sensitive data. The PolicyServer component is responsible for centralized policy management and enforcement in enterprise endpoint encryption deployments. The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L), indicating the attacker does not need to manipulate conditions beyond standard SQL injection techniques. The authentication requirement (PR:L) means this is a privilege escalation vector rather than an unauthenticated remote code execution.

RemediationAI

Remediation steps (to be confirmed against official Trend Micro advisory): (1) Apply security patch released by Trend Micro for Endpoint Encryption PolicyServer—patch version number TBD pending official advisory; (2) Prioritize patching in environments where PolicyServer is internet-accessible or reachable from potentially compromised systems; (3) Implement network segmentation to restrict access to PolicyServer admin interfaces to trusted administrative networks; (4) Apply principle of least privilege—ensure service accounts and administrative users have minimal necessary permissions; (5) Monitor PolicyServer logs and database audit trails for suspicious SQL patterns or privilege escalation attempts (authentication attempts from unusual accounts, policy modifications); (6) If patch is unavailable, implement WAF/IDS rules to detect SQL injection attempts (common payloads: UNION SELECT, stacked queries, boolean-based blind SQLi patterns); (7) Temporary workaround: restrict PolicyServer network access via firewall rules while patch is being tested/deployed. Contact Trend Micro support at https://success.trendmicro.com for patch availability and deployment timeline.