CVE-2023-34146: trend micro, inc. trend micro apex one Improper Privilege Management
Vulnerability summary
CVE-2023-34146 is a high (CVSS 7.8) Improper Privilege Management vulnerability in trend micro, inc. trend micro apex one. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.4% of scored vulnerabilities.
Timeline
- 26-06-2023PublishedVulnerability first disclosed.
- 04-12-2024Last modifiedVulnerability information updated.
Description
An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34147 and CVE-2023-34148.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
0.00 pp
From 0.23% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Trend micro, inc.1 product
- trend micro apex one≥ 2019, < 14.0.0.12033
Trendmicro1 product
- apex_one< 14.0.12518 | 2019
2 vendors · 2 products