VulnerabilityModified

CVE-2019-14685

A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate a specific product feature to load a malicious service.

HIGH 7.8EPSS 0.59%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.0: 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.59% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-428
Affected: trendmicro/antivirus \+ security 2019 · trendmicro/internet security 2019 · trendmicro/maximum security 2019 · trendmicro/premium security 2019
Source: security@trendmicro.com

References

http://packetstormsecurity.com/files/154200/Trend-Maximum-Security-2019-Unquoted-Search-Path.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Aug/26Mailing List, Third Party Advisory
https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123420.aspxVendor Advisory
https://medium.com/sidechannel-br/vulnerabilidade-no-trend-micro-maximum-security-2019-permite-a-escala%C3%A7%C3%A3o-de-privil%C3%A9gios-no-windows-471403d53b68Third Party Advisory
http://packetstormsecurity.com/files/154200/Trend-Maximum-Security-2019-Unquoted-Search-Path.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Aug/26Mailing List, Third Party Advisory
https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123420.aspxVendor Advisory
https://medium.com/sidechannel-br/vulnerabilidade-no-trend-micro-maximum-security-2019-permite-a-escala%C3%A7%C3%A3o-de-privil%C3%A9gios-no-windows-471403d53b68Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.