EUVD-2025-28286CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.
Analysis
Critical authentication bypass vulnerability in Trend Micro Endpoint Encryption PolicyServer that allows unauthenticated remote attackers to gain administrative access and modify product configurations without valid credentials. The vulnerability has a CVSS 9.8 score indicating severe impact (confidentiality, integrity, and availability compromised), and represents a complete authentication control failure requiring immediate patching.
Technical Context
The vulnerability exploits an improper authentication mechanism (CWE-477: Improperly Implemented Security Check for Standard) in the Trend Micro Endpoint Encryption PolicyServer's administrative API or web service layer. CWE-477 indicates the product implements security checks incorrectly or incompletely, allowing attackers to bypass intended access controls. The PolicyServer component is responsible for centralized policy management across encrypted endpoints; improper authentication in this service exposes administrative functionality to unauthenticated users. The network-based attack vector (AV:N) and low attack complexity (AC:L) suggest the vulnerability is exploitable without authentication (PR:N) or user interaction (UI:N) over standard network protocols, likely HTTP/HTTPS interfaces used for remote policy administration.
Affected Products
Trend Micro Endpoint Encryption PolicyServer (specific vulnerable versions not provided in description; refer to official Trend Micro security advisory for affected version ranges). Affected installations typically include PolicyServer deployed in enterprise environments managing endpoint encryption policies. Administrators should cross-reference the CVE against Trend Micro advisory ZDI reports and Trend Micro's official security bulletins for precise version information (e.g., versions before patched release). CPE data would follow pattern: cpe:2.3:a:trend_micro:endpoint_encryption_policyserver:*:*:*:*:*:*:*:* (version ranges to be determined from vendor advisory).
Remediation
1) Apply the security patch released by Trend Micro for Endpoint Encryption PolicyServer immediately upon availability (consult Trend Micro security advisory for specific patch version numbers). 2) If patches are unavailable, implement network-level access controls restricting PolicyServer administrative interfaces to trusted administrative networks only; use firewall rules to limit access to the PolicyServer port to authorized IP ranges. 3) Disable remote administrative access if not required; configure PolicyServer for local-only administration temporarily. 4) Monitor PolicyServer logs for suspicious administrative access patterns or configuration changes that may indicate exploitation. 5) Review and audit all recent configuration changes made through PolicyServer to identify potential attacker modifications. Contact Trend Micro support (support.trendmicro.com) for patch availability and deployment guidance specific to your PolicyServer version.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today