CVE-2023-41179: Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability

Vulnerability summary

CVE-2023-41179 is a high (CVSS 7.2) Code Injection vulnerability in Trend Micro Apex One and Worry-Free Business Security. It is known to be exploited: CISA lists it, first on 21-09-2023. EPSS estimates a 4.25% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities.

Timeline

1. 19-09-2023
   PublishedVulnerability first disclosed.
2. 21-09-2023
   Added to CISA KEVTrend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
3. 12-10-2023
   CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.