CVE-2019-15627

HIGH

Trendmicro Deep Security - Symlink Following

Title source: rule

Description

Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. Local OS access is required. Please note that only Windows agents are affected.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Peter Lapp · pythonlocalwindows

https://www.exploit-db.com/exploits/47751

View Code ZIP pw:eip

References (2)

[Vendor Advisory] https://success.trendmicro.com/solution/000149495

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/155579/Trend-Micro-Deep-Security-Agent-11-Arbitrary-File-Overwrite.html

Scores

CVSS v3 7.1

EPSS 0.0077

EPSS Percentile 73.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Details

CWE

CWE-59

Status published

Products (3)

trendmicro/deep_security 10.0

trendmicro/deep_security 11.0

trendmicro/deep_security 12.0

Published Oct 17, 2019

Tracked Since Feb 18, 2026