CVE-2019-14688

HIGH

Trend Micro Control Manager - Uncontrolled Search Path Element during Installation

Title source: llm

Description

Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://success.trendmicro.com/solution/1123562

Scores

CVSS v3 7.0

EPSS 0.0048

EPSS Percentile 65.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-427

Status published

Products (9)

trendmicro/control_manager 7.0

trendmicro/endpoint_sensor 1.6

trendmicro/im_security 1.6.5

trendmicro/mobile_security 9.8

trendmicro/officescan xg

trendmicro/scanmail 14.0

trendmicro/security 2019

trendmicro/serverprotect 5.8 (3 CPE variants)

trendmicro/serverprotect 6.0

Published Feb 20, 2020

Tracked Since Feb 18, 2026