Login Request a demo
High severity · published Sep 19, 2023
CVE-2023-41179
Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
In wildKEV
7.2
CVSS
4.2%
EPSS
Yes
On KEV
Description
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 21, 2023
Federal remediation dueOct 12, 2023
Ransomware campaign useNot known
Affected products
Which versions
AO
Apex One · Trend Micro
2019 (14.0) before 14.0.0.12380; SaaS before 14.0.12637 · source: vendor, NVD, CISA
TM
Trend Micro Worry-Free Business Security · Trend Micro, Inc.
10.0 SP1 before 10.0 SP1 Build 2495 · source: vendor
TM
Trend Micro Worry-Free Business Security Services · Trend Micro, Inc.
SaaS before 6.7.3578 / 14.3.1105 · source: vendor
WB
Worry-free Business Security · Trendmicro
10.0 · source: NVD, CISA
WB
Worry-free Business Security Services · Trendmicro
0 · source: NVD, CISA
AO
Apex One and Worry-Free Business Security · Trend Micro
All versions, or not specified · source: KEV
Affected product
AO
Apex One
Trend Micro
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41179
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41179
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
success.trendmicro.com
https://success.trendmicro.com/solution/000294994
success.trendmicro.com
https://success.trendmicro.com/jp/solution/000294706
jvn.jp
https://jvn.jp/en/vu/JVNVU90967486/
More from Apex One
9.8
CVE-2025-54948
Trend Micro Apex One OS Command Injection Vulnerability
9.8
CVE-2022-26871
Trend Micro Apex Central Arbitrary File Upload Vulnerability
9.8
CVE-2020-8599
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
8.8
CVE-2021-36741
Trend Micro Multiple Products Improper Input Validation Vulnerability
8.8
CVE-2020-8468
Trend Micro Multiple Products Content Validation Escape Vulnerability