Riskcovery

CVE-2023-41179

State
Published
Severity
7.2 High
Published
Sep 19, 2023
Updated
Oct 21, 2025
Reserved
Aug 24, 2023

Read the record on cve.org

Description

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation.

Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.

Scores

CVSSScoreVectorSource
3.17.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
Trend Micro Apex OneTrend Micro, Inc.
  • 2019 (14.0) to before 14.0.0.12380Affected
Trend Micro Apex OneTrend Micro, Inc.
  • SaaS to before 14.0.12637Affected
Trend Micro Worry-Free Business SecurityTrend Micro, Inc.
  • 10.0 SP1 to before 10.0 SP1 Build 2495Affected
Trend Micro Worry-Free Business Security ServicesTrend Micro, Inc.
  • SaaS to before 6.7.3578 / 14.3.1105Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.