CVE-2022-40139

Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability

Severity Score

7.2

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

*SSVC

Descriptions

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.

Una comprobación inapropiada de algunos componentes usados por el mecanismo de reversión en los clientes de Trend Micro Apex One y Trend Micro Apex One as a Service podría permitir a un administrador del servidor Apex One indicar a clientes afectados descargar un paquete de reversión no verificado, lo que podría conllevar a una ejecución de código remota. Nota: un atacante debe obtener primero el acceso a la consola de administración del servidor Apex One para poder explotar esta vulnerabilidad

Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.

*Credits: N/A

CVSS Scores

NISTv3.1 7.2

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-09-06 CVE Reserved
2022-09-15 Exploited in Wild
2022-09-19 CVE Published
2022-10-06 KEV Due Date
2024-08-03 CVE Updated
2024-09-03 EPSS Updated
---------- First Exploit

CWE

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://success.trendmicro.com/solution/000291528	2023-08-08

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Trendmicro Search vendor "Trendmicro"	Apex One Search vendor "Trendmicro" for product "Apex One"	-	saas	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Trendmicro Search vendor "Trendmicro"	Apex One Search vendor "Trendmicro" for product "Apex One"	2019 Search vendor "Trendmicro" for product "Apex One" and version "2019"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe