Trend Micro EUVD-2025-28284

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates: network-accessible attack vector with low attack complexity and low privileges required (post-authentication), no user interaction needed, and high impact across all three security properties. However, the critical constraint is the prerequisite: an attacker must already possess low-privileged code execution capability on the target system. This substantially reduces CVSS severity in most threat models to below critical. The real-world risk depends on: (1) organizational deployment of PolicyServer in environments where low-privileged code execution is likely (workstations vs. hardened servers), (2) network segmentation preventing unauthorized access to PolicyServer, and (3) the existence of prerequisite vulnerabilities enabling initial low-privileged code access. Without KEV/CISA notification status, active POC, or EPSS probability data visible in this CVE description, treat this as a targeted threat rather than mass-exploitation risk, but prioritize remediation in high-value environments where PolicyServer is internet-exposed or accessible from untrusted subnets.

An attacker gains low-privileged access to a Windows workstation (via phishing malware, vulnerable application, or insider threat) within an organization running Trend Micro Endpoint Encryption PolicyServer on an internal network. From this workstation, the attacker connects to the PolicyServer (either directly if on the same subnet, or via lateral movement through internal network access). The attacker authenticates using compromised low-privileged credentials or a service account with PolicyServer access. The attacker crafts a malicious serialized Java/.NET object embedding arbitrary code execution payloads and sends it to a vulnerable PolicyServer API endpoint. During deserialization, the PolicyServer reconstructs the object without input validation, triggering code execution in the context of the PolicyServer process (typically SYSTEM/root). The attacker achieves remote code execution with full system privileges, enabling installation of persistent backdoors, lateral movement to other systems via the encryption infrastructure, or exfiltration of sensitive keys/encrypted data. This scenario is realistic in environments with weak endpoint security posture, but the multi-stage prerequisite (initial compromise → PolicyServer network access → credential acquisition) substantially limits opportunistic exploitation.