7.8

CVE-2025-30640

A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Trendmicro ≫ Deep Security Agent SwEditionlong_term_support Version < 20.0.1
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Update- SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate12510 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate14610 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate17380 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate19250 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate21510 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate23340 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate3180 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate4540 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate690 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate7380 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Trendmicro ≫ Deep Security Agent Version20.0.1 Updateupdate9400 SwEditionlong_term_support
   Microsoft ≫ Windows Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.064
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
security@trendmicro.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.