EUVD-2025-28283
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Lifecycle Timeline
3Description
A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
Analysis
SQL injection vulnerability in Trend Micro Endpoint Encryption PolicyServer that enables privilege escalation on affected systems. The vulnerability requires an attacker to first obtain low-privileged code execution on the target system, after which SQL injection can be leveraged to escalate privileges and gain high-impact access (confidentiality compromise, integrity violation, availability disruption). With a CVSS score of 7.7 and local attack vector, this poses a significant risk to organizations running vulnerable PolicyServer instances, particularly in multi-user environments or where low-privileged service accounts are present.
Technical Context
The vulnerability is a classic SQL injection flaw (CWE-89) within Trend Micro's Endpoint Encryption PolicyServer component. SQL injection occurs when user-supplied or application-controlled input is improperly sanitized before being incorporated into SQL queries, allowing attackers to manipulate query logic. In this case, an authenticated local user with low privileges can craft malicious input that breaks out of intended SQL statement boundaries, enabling them to execute arbitrary SQL commands. This likely affects the PolicyServer's database interaction layer, which manages encryption policies, user credentials, or system configurations. The local attack vector (AV:L) indicates the attacker must have prior system access; the high complexity (AC:H) suggests specific conditions or user interaction may be required to trigger the vulnerability; and the low privilege requirement (PR:L) means any authenticated local user can attempt exploitation. The scope change (S:C) indicates the vulnerability can impact resources beyond the vulnerable component itself, enabling broader system compromise.
Affected Products
Trend Micro Endpoint Encryption PolicyServer (specific versions not detailed in provided description; refer to Trend Micro security advisory for exact version ranges). Affected CPE likely includes: cpe:2.3:a:trendmicro:endpoint_encryption:*:*:*:*:*:*:*:* with PolicyServer component versions vulnerable to SQL injection. Organizations should consult Trend Micro's official security advisory and vulnerability database for exact affected version ranges, as PolicyServer version numbering may not align directly with Endpoint Encryption product versions. Patch advisories and affected version lists should be obtained directly from Trend Micro's security support portal.
Remediation
1. Apply security patches from Trend Micro addressing CVE-2025-49211 to all affected PolicyServer installations—contact Trend Micro support or check the security advisory for specific patch versions and deployment procedures. 2. As an immediate interim mitigation, restrict local access to PolicyServer systems to only authorized administrators and required service accounts; implement role-based access control (RBAC) to minimize the number of low-privileged users with system access. 3. Implement database activity monitoring (DAM) on the PolicyServer database backend to detect and alert on suspicious SQL patterns or unusual query execution. 4. Apply principle of least privilege to database service accounts—ensure PolicyServer database accounts operate with minimal required permissions (no DDL/DML on non-policy tables). 5. Isolate PolicyServer systems on a dedicated network segment with restricted inbound access; use firewall rules to limit access to authorized administrative systems only. 6. If immediate patching is not feasible, consider disabling PolicyServer functionality that is not actively required, or temporarily migrating to an alternative encryption policy management solution.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today