Medium severity · published Jan 18, 2020
CVE-2019-19696
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized…
5.5
CVSS
0.5%
EPSS
No
On KEV
Description
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishing sites.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Password Manager · Trendmicro
5.0 through 5.0.0.1076; 5.0 through 5.0.1047 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19696
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19696
Vendor Advisory
https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124092.aspx
Vendor Advisory
https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1124091.aspx
Third Party Advisory
https://jvn.jp/en/jp/JVN37183636/index.html
Third Party Advisory
https://jvn.jp/jp/JVN37183636/index.html
More from Password Manager
9.8
CVE-2016-3987
The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB
8.8
CVE-2021-32462
Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Exposed Hazardous Function Remote Code Execution vulnerability which could allow an…
7.8
CVE-2025-52837
Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the…
7.8
CVE-2022-28394
EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated contains an issue with the DLL search…
7.8
CVE-2022-30523
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a low privileged local…