2025-0610-tm-tmee-001
HIGH CVSS 7.7 csaf_trend
Description
CRITICAL SECURITY BULLETIN: Trend Micro Endpoint Encryption PolicyServer (June 2025)
Timeline
- Published
- 2025-06-10 10:00 UTC
- Last Modified
- 2025-06-10
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"notes": [
{
"category": "summary",
"text": "CRITICAL SECURITY BULLETIN: Trend Micro Endpoint Encryption PolicyServer (June 2025)",
"title": "Title"
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@trendmicro.com",
"issuing_authority": "Trend Micro PSIRT",
"name": "Trend Micro",
"namespace": "https://www.trendmicro.com/vulnerability"
},
"references": [
{
"summary": "Trend Micro Security Bulletin",
"url": "https://success.trendmicro.com/en-US/solution/KA-0019928"
}
],
"title": "CRITICAL SECURITY BULLETIN: Trend Micro Endpoint Encryption PolicyServer (June 2025)",
"tracking": {
"current_release_date": "2025-06-10T10:00:00.000Z",
"generator": {
"date": "2025-07-23T18:52:10.745Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.31"
}
},
"id": "2025-0610-TM-TMEE-001",
"initial_release_date": "2025-06-10T10:00:00.000Z",
"revision_history": [
{
"date": "2025-06-10T10:00:00.000Z",
"number": "1",
"summary": "Initial version."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "6.0",
"product": {
"name": "Trend Micro Endpoint Encryption Policy Server",
"product_id": "TM-TMEE-001"
}
}
],
"category": "product_name",
"name": "Endpoint Encryption Policy Server"
}
],
"category": "vendor",
"name": "Trend Micro"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Zero Day Initiative"
]
}
],
"cve": "CVE-2025-49211",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
},
"notes": [
{
"category": "description",
"text": "A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. \n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"known_affected": [
"TM-TMEE-001"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-25528",
"url": "https://www.zerodayinitiative.com/advisories/published/"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-10T19:00:00.000Z",
"details": "Customers should update to Patch 1 Update 6 (Version 6.0.0.4013) to resolve the issue.",
"product_ids": [
"TM-TMEE-001"
],
"url": "https://downloadcenter.trendmicro.com/index.php?regs=nabu&prodid=1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"environmentalScore": 7.7,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"temporalScore": 7.7,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-TMEE-001"
]
}
],
"title": "SQL Injection Privilege Escalation"
},
{
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Zero Day Initiative"
]
}
],
"cve": "CVE-2025-49212",
"cwe": {
"id": "CWE-477",
"name": "Use of Obsolete Function"
},
"notes": [
{
"category": "description",
"text": "An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.",
"title": "CVE description"
}
],
"product_status": {
"known_affected": [
"TM-TMEE-001"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-25507",
"url": "https://www.zerodayinitiative.com/advisories/published/"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-10T19:00:00.000Z",
"details": "Customers should update to Patch 1 Update 6 (Version 6.0.0.4013) to resolve the issue.",
"product_ids": [
"TM-TMEE-001"
],
"url": "https://downloadcenter.trendmicro.com/index.php?regs=nabu&prodid=1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-TMEE-001"
]
}
],
"title": " Deserialization of Untrusted Data RCE"
},
{
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Zero Day Initiative"
]
}
],
"cve": "CVE-2025-49213",
"cwe": {
"id": "CWE-477",
"name": "Use of Obsolete Function"
},
"notes": [
{
"category": "description",
"text": "An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method.",
"title": "CVE description"
}
],
"product_status": {
"known_affected": [
"TM-TMEE-001"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-25506",
"url": "https://www.zerodayinitiative.com/advisories/published/"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-10T19:00:00.000Z",
"details": "Customers should update to Patch 1 Update 6 (Version 6.0.0.4013) to resolve the issue.",
"product_ids": [
"TM-TMEE-001"
],
"url": "https://downloadcenter.trendmicro.com/index.php?regs=nabu&prodid=1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"environmentalScore": 7.7,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"temporalScore": 7.7,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-TMEE-001"
]
}
],
"title": "Deserialization of Untrusted Data RCE"
},
{
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Zero Day Initiative"
]
}
],
"cve": "CVE-2025-49214",
"cwe": {
"id": "CWE-477",
"name": "Use of Obsolete Function"
},
"notes": [
{
"category": "description",
"text": "An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"known_affected": [
"TM-TMEE-001"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-25518",
"url": "https://www.zerodayinitiative.com/advisories/published/"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-10T19:00:00.000Z",
"details": "Customers should update to Patch 1 Update 6 (Version 6.0.0.4013) to resolve the issue.",
"product_ids": [
"TM-TMEE-001"
],
"url": "https://downloadcenter.trendmicro.com/index.php?regs=nabu&prodid=1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-TMEE-001"
]
}
],
"title": "Deserialization of Untrusted Data RCE"
},
{
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Zero Day Initiative"
]
}
],
"cve": "CVE-2025-49215",
"cwe": {
"id": "CWE-242",
"name": "Use of Inherently Dangerous Function"
},
"notes": [
{
"category": "description",
"text": "A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. \n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"known_affected": [
"TM-TMEE-001"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-25528",
"url": "https://www.zerodayinitiative.com/advisories/published/"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-10T19:00:00.000Z",
"details": "Customers should update to Patch 1 Update 6 (Version 6.0.0.4013) to resolve the issue.",
"product_ids": [
"TM-TMEE-001"
],
"url": "https://downloadcenter.trendmicro.com/index.php?regs=nabu&prodid=1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-TMEE-001"
]
}
],
"title": "SQL Injection Privilege Escalation"
},
{
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Zero Day Initiative"
]
}
],
"cve": "CVE-2025-49216",
"cwe": {
"id": "CWE-477",
"name": "Use of Obsolete Function"
},
"notes": [
{
"category": "description",
"text": "An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations. ",
"title": "CVE description"
}
],
"product_status": {
"known_affected": [
"TM-TMEE-001"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-25519",
"url": "https://www.zerodayinitiative.com/advisories/published/"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-10T19:00:00.000Z",
"details": "Customers should update to Patch 1 Update 6 (Version 6.0.0.4013) to resolve the issue.",
"product_ids": [
"TM-TMEE-001"
],
"url": "https://downloadcenter.trendmicro.com/index.php?regs=nabu&prodid=1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-TMEE-001"
]
}
],
"title": "Authentication Bypass"
},
{
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Zero Day Initiative"
]
}
],
"cve": "CVE-2025-49217",
"cwe": {
"id": "CWE-477",
"name": "Use of Obsolete Function"
},
"notes": [
{
"category": "description",
"text": "An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method.",
"title": "CVE description"
}
],
"product_status": {
"known_affected": [
"TM-TMEE-001"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-25505",
"url": "https://www.zerodayinitiative.com/advisories/published/"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-10T19:00:00.000Z",
"details": "Customers should update to Patch 1 Update 6 (Version 6.0.0.4013) to resolve the issue.",
"product_ids": [
"TM-TMEE-001"
],
"url": "https://downloadcenter.trendmicro.com/index.php?regs=nabu&prodid=1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-TMEE-001"
]
}
],
"title": "Deserialization of Untrusted Data RCE"
},
{
"acknowledgments": [
{
"names": [
"Piotr Bazydlo (@chudypb) of Trend Zero Day Initiative"
]
}
],
"cve": "CVE-2025-49218",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
},
"notes": [
{
"category": "description",
"text": "A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"known_affected": [
"TM-TMEE-001"
]
},
"references": [
{
"category": "external",
"summary": "ZDI-CAN-25526",
"url": "https://www.zerodayinitiative.com/advisories/published/"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-10T19:00:00.000Z",
"details": "Customers should update to Patch 1 Update 6 (Version 6.0.0.4013) to resolve the issue.",
"product_ids": [
"TM-TMEE-001"
],
"url": "https://downloadcenter.trendmicro.com/index.php?regs=nabu&prodid=1746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"environmentalScore": 7.7,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"temporalScore": 7.7,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"TM-TMEE-001"
]
}
],
"title": "SQL Injection Privilege Escalation"
}
]
}