EUVD-2025-27792
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Analysis
Link following vulnerability (symlink attack) in Trend Micro Deep Security 20.0 agents that enables local privilege escalation on affected systems. An attacker with low-privileged code execution capability can exploit this flaw to gain high-level system access. The vulnerability has a CVSS score of 7.8 with high impact across confidentiality, integrity, and availability; KEV and POC status are not confirmed in available data, but the low attack complexity and low privilege requirement indicate moderate real-world risk once initial code execution is obtained.
Technical Context
This vulnerability stems from CWE-59 (Improper Link Resolution Before File Access), a classic link-following or symlink attack. The Deep Security agent likely fails to properly validate or resolve symbolic links before performing file operations with elevated privileges. When the agent accesses files or directories as root/SYSTEM, an unprivileged user can create malicious symlinks pointing to sensitive system files or directories. The agent then follows these links and modifies targets that the attacker could not directly access, achieving privilege escalation. This typically occurs in temporary directories, cache locations, or log file handling where agents write or read files without proper link validation. Affected: Trend Micro Deep Security agents version 20.0; CPE context would be `cpe:2.3:a:trendmicro:deep_security_agent:20.0:*:*:*:*:*:*:*` and related variants.
Affected Products
- vendor: Trend Micro; product: Deep Security Agent; affected_version: 20.0; cpe: cpe:2.3:a:trendmicro:deep_security_agent:20.0:*:*:*:*:*:*:*; impact: All installations of Deep Security 20.0 agents on Windows, Linux, and macOS are potentially vulnerable if they perform file operations susceptible to symlink attacks
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today