CVE-2024-55955: trend micro, inc. trend micro deep security Uncontrolled Search Path Element

Vulnerability summary

CVE-2024-55955 is a high (CVSS 7.3) Uncontrolled Search Path Element vulnerability in trend micro, inc. trend micro deep security. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.6% of scored vulnerabilities.

Timeline

1. 31-12-2024
   PublishedVulnerability first disclosed.
2. 05-03-2025
   Last modifiedVulnerability information updated.

Description

An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.