CVE-2023-28929: trend micro, inc. trend micro security (consumer) Uncontrolled Search Path Element

Vulnerability summary

CVE-2023-28929 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in trend micro, inc. trend micro security (consumer). EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29% of scored vulnerabilities.

Timeline

1. 26-06-2023
   PublishedVulnerability first disclosed.
2. 05-12-2024
   Last modifiedVulnerability information updated.

Description

Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable file as an execution and/or persistence mechanism which could execute a malicious program each time the executable file is started.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.