EUVD-2025-27793
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Analysis
Link following (symlink) vulnerability in Trend Micro Deep Security 20.0 agent's anti-malware component that enables local privilege escalation. An attacker with low-privileged code execution can exploit this to gain elevated system privileges (confidentiality, integrity, and availability impact). While no public exploit or active exploitation in the wild has been confirmed, the CVSS 7.8 score and low attack complexity indicate this poses a significant risk to organizations running vulnerable versions.
Technical Context
This vulnerability exploits CWE-59 (Improper Link Resolution Before File Access, aka 'Link Following'), a classic privilege escalation flaw where a privileged process follows attacker-controlled symbolic links or hard links without proper validation. In Trend Micro Deep Security's anti-malware engine, the affected code likely performs file operations (scanning, logging, or remediation actions) with elevated privileges while failing to verify that file paths have not been redirected via symlinks to sensitive system locations (/etc/sudoers, /root/.ssh, kernel modules, etc.). The vulnerability is specific to Trend Micro Deep Security version 20.0 agents, which are typically installed with system/root privileges. The anti-malware module's file handling during scan operations or threat remediation is the likely attack surface. CPE identifier would be: cpe:2.3:a:trendmicro:deep_security:20.0:*:*:*:*:*:*:*
Affected Products
Trend Micro Deep Security Agent version 20.0 (all patch levels unless specified otherwise in vendor advisories). The vulnerability affects both on-premises and cloud-based deployments where the agent runs with elevated privileges. The product is commonly deployed across Windows, Linux, and macOS endpoints. CPE: cpe:2.3:a:trendmicro:deep_security:20.0:*:*:*:*:*:*:* . Administrators should consult the official Trend Micro Security Advisory for Deep Security to confirm exact patch availability and affected sub-versions (20.0.0, 20.0.1, etc.).
Remediation
Immediate remediation: (1) Apply the latest Trend Micro Deep Security Agent patch beyond version 20.0; Trend Micro typically releases patches in the 20.0.x.x sequence or recommends upgrading to version 21.x or later. Check the official Trend Micro Deep Security release notes and security advisory portal for specific patched versions. (2) Interim mitigation: Restrict local user account privileges and limit code execution contexts for untrusted users on systems running Deep Security 20.0. Implement file system access controls to prevent unprivileged users from creating symlinks in directories where the Deep Security agent writes logs or temporary files (typically /var/log, /tmp, /var/tmp on Linux). (3) Monitor: Enable audit logging for symlink creation and privilege escalation attempts. (4) Vendor advisory: Review Trend Micro's official CVE-2025-30641 advisory for patch download links and validation checksums.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today