What is the CVSS score of CVE-2025-52837?

CVE-2025-52837 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Password Manager are affected by CVE-2025-52837?

Trend Micro Password Manager versions 5.8.0.1327 and below contain a privilege escalation vulnerability that allows authenticated local users to delete arbitrary files and gain elevated system…. A patch is available.

How to fix or mitigate CVE-2025-52837?

Within 24 hours: Identify all systems running Trend Micro Password Manager versions 5.8.0.1327 and below using endpoint inventory tools. Within 7 days: Update all affected installations to version 5.8.0.1328 or later (vendor-released patch). Within 30 days: Audit systems for signs of unauthorized file deletion or privilege escalation in Security Event Logs; review local user account access controls and implement principle of least privilege for all Password Manager user accounts.

Password Manager CVE-2025-52837

EUVD-2025-21041 HIGH

Windows Shortcut Following (.LNK) (CWE-64)

2025-07-10 security@trendmicro.com

Privilege Escalation Password Manager

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:28 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.8.0.1327

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21041

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

CVE Published

Jul 10, 2025 - 19:15 nvd

HIGH 7.8

DescriptionCVE.org

Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportunity to abuse symbolic links and other methods to delete any file/folder and achieve privilege escalation.

AnalysisAI

Trend Micro Password Manager (Consumer) versions 5.8.0.1327 and below contains a privilege escalation vulnerability exploiting symbolic link following and file/folder deletion capabilities. An authenticated local attacker with low privileges can leverage this vulnerability to delete arbitrary files and escalate privileges on the affected system. While no active exploitation in the wild has been publicly confirmed as of this analysis, the local attack vector and straightforward nature of symbolic link exploitation represent meaningful risk to Password Manager users.

Technical ContextAI

This vulnerability (CWE-64: Improper Link Following) represents a classic insecure file operation flaw where Trend Micro Password Manager fails to safely validate file paths before performing privileged operations. The vulnerability allows attackers to create or manipulate symbolic links in predictable locations that the Password Manager process (likely running with elevated privileges or in a protected context) will follow without proper validation. When the application dereferences these malicious symlinks during file deletion or maintenance operations, it operates on attacker-controlled targets rather than intended files. This is a common vulnerability class in privileged service/daemon applications that perform file operations without using secure alternatives (e.g., O_NOFOLLOW flags, realpath validation, or secure temp file handling). The affected CPE scope is specifically Trend Micro Password Manager Consumer edition, version 5.8.0.1327 and all earlier versions.

RemediationAI

Upgrade Trend Micro Password Manager (Consumer) to version 5.8.0.1328 or later. Check Trend Micro Security Support Portal for the latest available version and patch release notes.; priority: High Workaround (Temporary): Restrict local user access and limit unprivileged user accounts that can interact with Password Manager processes. Run Password Manager with minimal required privileges if possible. Monitor for suspicious file deletion operations in system logs.; priority: Medium Mitigation: Implement file integrity monitoring on critical system directories. Use host-based intrusion detection to alert on suspicious symbolic link creation in predictable temp or application directories. Enforce strict file permission policies.; priority: Medium Detection: Monitor for creation of symbolic links in %TEMP%, %APPDATA%, and Password Manager installation directories by non-administrative users. Review event logs for unexpected file deletion operations initiated by Password Manager process.; priority: Medium