What is the CVSS score of EUVD-2025-28283?

EUVD-2025-28283 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Trend Micro are affected by EUVD-2025-28283?

Trend Micro Endpoint Encryption PolicyServer contains a SQL injection vulnerability (CVE-2025-49211) that allows attackers with low-privileged code execution to escalate privileges and compromise…. A patch is available.

How to fix or mitigate EUVD-2025-28283?

Within 24 hours: identify all Trend Micro Endpoint Encryption PolicyServer instances in your environment and document current versions. Within 7 days: obtain and test the vendor-released patch in a non-production environment to validate compatibility with your encryption policies and dependent systems. Within 30 days: deploy patched PolicyServer versions to all production instances, prioritizing systems in multi-user or high-sensitivity data environments; verify patch application and conduct access control review of service accounts with low-privilege execution rights.

Trend Micro EUVD-2025-28283

| CVE-2025-49211 HIGH

SQL Injection (CWE-89)

2025-06-17 security@trendmicro.com

SQLi Trend Micro Privilege Escalation Trend Micro Endpoint Encryption

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:37 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.0.0.4013

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28283

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 21:15 nvd

HIGH 7.7

DescriptionCVE.org

A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.

AnalysisAI

SQL injection vulnerability in Trend Micro Endpoint Encryption PolicyServer that enables privilege escalation on affected systems. The vulnerability requires an attacker to first obtain low-privileged code execution on the target system, after which SQL injection can be leveraged to escalate privileges and gain high-impact access (confidentiality compromise, integrity violation, availability disruption). With a CVSS score of 7.7 and local attack vector, this poses a significant risk to organizations running vulnerable PolicyServer instances, particularly in multi-user environments or where low-privileged service accounts are present.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) within Trend Micro's Endpoint Encryption PolicyServer component. SQL injection occurs when user-supplied or application-controlled input is improperly sanitized before being incorporated into SQL queries, allowing attackers to manipulate query logic. In this case, an authenticated local user with low privileges can craft malicious input that breaks out of intended SQL statement boundaries, enabling them to execute arbitrary SQL commands. This likely affects the PolicyServer's database interaction layer, which manages encryption policies, user credentials, or system configurations. The local attack vector (AV:L) indicates the attacker must have prior system access; the high complexity (AC:H) suggests specific conditions or user interaction may be required to trigger the vulnerability; and the low privilege requirement (PR:L) means any authenticated local user can attempt exploitation. The scope change (S:C) indicates the vulnerability can impact resources beyond the vulnerable component itself, enabling broader system compromise.

RemediationAI

Apply security patches from Trend Micro addressing CVE-2025-49211 to all affected PolicyServer installations—contact Trend Micro support or check the security advisory for specific patch versions and deployment procedures. 2. As an immediate interim mitigation, restrict local access to PolicyServer systems to only authorized administrators and required service accounts; implement role-based access control (RBAC) to minimize the number of low-privileged users with system access. 3. Implement database activity monitoring (DAM) on the PolicyServer database backend to detect and alert on suspicious SQL patterns or unusual query execution. 4. Apply principle of least privilege to database service accounts—ensure PolicyServer database accounts operate with minimal required permissions (no DDL/DML on non-policy tables). 5. Isolate PolicyServer systems on a dedicated network segment with restricted inbound access; use firewall rules to limit access to authorized administrative systems only. 6. If immediate patching is not feasible, consider disabling PolicyServer functionality that is not actively required, or temporarily migrating to an alternative encryption policy management solution.