2025-0627-TM-WF-001

Vulnerability from csaf_trendmicro - Published: 2025-06-27 10:00 - Updated: 2025-06-27 10:00
Summary
SECURITY BULLETIN: June 2025 for Trend Micro Worry-Free Business Security and Worry-Free Business Security Services
Notes
Title: SECURITY BULLETIN: June 2025 for Trend Micro Worry-Free Business Security and Worry-Free Business Security Services
CVE-2025-49154

An insecure access control vulnerability in Trend Micro Worry-Free Business Security and Worry-Free Business Security Services could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

8.7 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CWE-284 - Improper Access Control
Affected products
Product Identifier Version Remediation
Worry-Free Business Security
Trend Micro / Worry-Free Business Security
 10.0 SP1
Vendor Fix fix
Product Identifier Version Remediation
Worry-Free Business Services Services
Trend Micro / Worry-Free Business Security Services
 6.7
Vendor Fix
CVE-2025-49487

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in order to exploit this vulnerability due to need to access a certain hardware component. Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a previous WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.

8.7 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CWE-427 - Uncontrolled Search Path Element
Affected products
Product Identifier Version Remediation
Worry-Free Business Services Services
Trend Micro / Worry-Free Business Security Services
 6.7
Vendor Fix
CVE-2025-53378

A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to remotely take control of the agent on affected installations. Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.

8.7 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CWE-284 - Improper Access Control
Affected products
Product Identifier Version Remediation
Worry-Free Business Services Services
Trend Micro / Worry-Free Business Security Services
 6.7
Vendor Fix
References
Acknowledgments
Alexander Pudwill
Will Dormann working with Trend Zero Day Initiative
Nicolas Caluori working with Trend Zero Day Initiative
To clipboard 

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "SECURITY BULLETIN: June 2025 for Trend Micro Worry-Free Business Security and Worry-Free Business Security Services",
        "title": "Title"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@trendmicro.com",
      "issuing_authority": "Trend Micro PSIRT",
      "name": "Trend Micro",
      "namespace": "https://www.trendmicro.com/vulnerability"
    },
    "references": [
      {
        "category": "self",
        "summary": "Trend Micro Security Bulletin",
        "url": "https://success.trendmicro.com/en-US/solution/KA-0019936"
      }
    ],
    "title": "SECURITY BULLETIN: June 2025 for Trend Micro Worry-Free Business Security and Worry-Free Business Security Services",
    "tracking": {
      "current_release_date": "2025-06-27T10:00:00.000Z",
      "generator": {
        "date": "2025-07-23T18:32:09.101Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.31"
        }
      },
      "id": "2025-0627-TM-WF-001",
      "initial_release_date": "2025-06-27T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-06-27T10:00:00.000Z",
          "number": "1",
          "summary": "Initial version."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.0 SP1",
                "product": {
                  "name": "Worry-Free Business Security",
                  "product_id": "TM-WFBS-001"
                }
              }
            ],
            "category": "product_name",
            "name": "Worry-Free Business Security"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.7",
                "product": {
                  "name": "Worry-Free Business Services Services",
                  "product_id": "TM-WFBSS-001"
                }
              }
            ],
            "category": "product_name",
            "name": "Worry-Free Business Security Services"
          }
        ],
        "category": "vendor",
        "name": "Trend Micro"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Alexander Pudwill"
          ],
          "summary": "Trend Micro would like to thank the following individuals for responsibly reporting these issues: Alexander Pudwill"
        }
      ],
      "cve": "CVE-2025-49154",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "description",
          "text": "An insecure access control vulnerability in Trend Micro Worry-Free Business Security and Worry-Free Business Security Services could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-WFBSS-001"
        ],
        "known_affected": [
          "TM-WFBS-001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-27T19:00:00.000Z",
          "details": "WFBS 10 SP1 Patch 2514",
          "product_ids": [
            "TM-WFBS-001"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2025-05-23T19:00:00.000Z",
          "details": "May 2025 Monthly Release\n(6.7.3954 / 14.3.1299)",
          "product_ids": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "environmentalScore": 8.7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 8.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-WFBS-001",
            "TM-WFBSS-001"
          ]
        }
      ],
      "title": "Insecure Access Control"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Will Dormann working with Trend Zero Day Initiative"
          ],
          "summary": "Trend Micro would like to thank the following individuals for responsibly reporting these issues: Will Dormann working with Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "cve": "CVE-2025-49487",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "description",
          "text": "An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations.\r\n\r\nAn attacker must have had physical access to the target system in order to exploit this vulnerability due to need to access a certain hardware component.\r\n\r\nAlso note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a previous WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-WFBSS-001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-23056",
          "url": "http://zerodayinitiative.com/advisories/published/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "May 2025 Monthly Release\n(6.7.3954 / 14.3.1299)",
          "product_ids": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "environmentalScore": 8.7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 8.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "title": "Uncontrolled Search Path Element Arbitrary Code Execution"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Nicolas Caluori working with Trend Zero Day Initiative"
          ],
          "summary": "Trend Micro would like to thank the following individuals for responsibly reporting these issues: Nicolas Caluori working with Trend Micro\u0027s Zero Day Initiative"
        }
      ],
      "cve": "CVE-2025-53378",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "description",
          "text": "A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to remotely take control of the agent on affected installations.\r\n\r\nAlso note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-WFBSS-001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-25342",
          "url": "http://zerodayinitiative.com/advisories/published/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "May 2025 Monthly Release\n(6.7.3954 / 14.3.1299)",
          "product_ids": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "environmentalScore": 8.7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 8.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "title": "Missing Authentication"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.