Trellix Network Security CVE-2025-7958

Exploitation requires an account with full administrative privileges to the Trellix Network Security web management interface (PR:H) and network reachability to that management interface on an adjacent/management network (AV:A), not anonymous internet access. The specific abused feature is the Alert artifact details view in the web UI, where attacker-influenced artifact content is injected and executed (CWE-94). Limiting factors that reduce real-world risk: the attacker must already be a trusted admin (so this is a post-authentication privilege/trust-boundary escape, not initial access), exploitation is constrained to whoever can reach the management plane, and no user interaction by a victim is required (UI:N). There is a description-versus-vector discrepancy ('locally authenticated' vs AV:A adjacent) that defenders should resolve against the vendor advisory before scoping exposure.

Signals are mixed and point to a real-but-gated risk rather than an emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N → 7.1 High) requires adjacent-network access and high privileges (PR:H = an authenticated admin), which substantially limits the population of capable attackers; vulnerable-system impact is full C/I/A (VC:H/VI:H/VA:H) with no scope change (SC/SI/SA:N). The E:P maturity flag indicates proof-of-concept code is known to exist, but the vulnerability is NOT in CISA KEV and there is no evidence of in-the-wild exploitation, so POC availability should not be conflated with active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be cited. Note a tension worth verifying: the description says 'locally authenticated' while the CVSS vector encodes AV:A (adjacent), suggesting exploitation over a management/adjacent network rather than strictly physical-local - confirm the intended access path with the vendor advisory. Because PR:H means the attacker already holds administrative control of a security appliance, the practical risk is admin-to-underlying-OS code execution (defense-evasion / persistence on the security stack) rather than initial compromise.

An attacker who has already obtained or compromised an administrator account on a Trellix Network Security appliance - for example via reused credentials or a malicious insider on the management network - navigates to an Alert's artifact detail view and injects crafted content into an artifact field that the web interface evaluates as code. When that view is processed, the payload executes on the appliance, giving the attacker arbitrary command execution on a core security device. Proof-of-concept material is indicated by the CVSS E:P flag, but no public weaponized exploit or active exploitation is confirmed.