2025-0627-tm-wf-001

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "SECURITY BULLETIN: June 2025 for Trend Micro Worry-Free Business Security and Worry-Free Business Security Services",
        "title": "Title"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@trendmicro.com",
      "issuing_authority": "Trend Micro PSIRT",
      "name": "Trend Micro",
      "namespace": "https://www.trendmicro.com/vulnerability"
    },
    "references": [
      {
        "category": "self",
        "summary": "Trend Micro Security Bulletin",
        "url": "https://success.trendmicro.com/en-US/solution/KA-0019936"
      }
    ],
    "title": "SECURITY BULLETIN: June 2025 for Trend Micro Worry-Free Business Security and Worry-Free Business Security Services",
    "tracking": {
      "current_release_date": "2025-06-27T10:00:00.000Z",
      "generator": {
        "date": "2025-07-23T18:32:09.101Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.31"
        }
      },
      "id": "2025-0627-TM-WF-001",
      "initial_release_date": "2025-06-27T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-06-27T10:00:00.000Z",
          "number": "1",
          "summary": "Initial version."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.0 SP1",
                "product": {
                  "name": "Worry-Free Business Security",
                  "product_id": "TM-WFBS-001"
                }
              }
            ],
            "category": "product_name",
            "name": "Worry-Free Business Security"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.7",
                "product": {
                  "name": "Worry-Free Business Services Services",
                  "product_id": "TM-WFBSS-001"
                }
              }
            ],
            "category": "product_name",
            "name": "Worry-Free Business Security Services"
          }
        ],
        "category": "vendor",
        "name": "Trend Micro"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Alexander Pudwill"
          ],
          "summary": "Trend Micro would like to thank the following individuals for responsibly reporting these issues: Alexander Pudwill"
        }
      ],
      "cve": "CVE-2025-49154",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "description",
          "text": "An insecure access control vulnerability in Trend Micro Worry-Free Business Security and Worry-Free Business Security Services could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-WFBSS-001"
        ],
        "known_affected": [
          "TM-WFBS-001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-27T19:00:00.000Z",
          "details": "WFBS 10 SP1 Patch 2514",
          "product_ids": [
            "TM-WFBS-001"
          ],
          "url": "http://downloadcenter.trendmicro.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2025-05-23T19:00:00.000Z",
          "details": "May 2025 Monthly Release\n(6.7.3954 / 14.3.1299)",
          "product_ids": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "environmentalScore": 8.7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 8.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-WFBS-001",
            "TM-WFBSS-001"
          ]
        }
      ],
      "title": "Insecure Access Control"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Will Dormann working with Trend Zero Day Initiative"
          ],
          "summary": "Trend Micro would like to thank the following individuals for responsibly reporting these issues: Will Dormann working with Trend Micro's Zero Day Initiative"
        }
      ],
      "cve": "CVE-2025-49487",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "description",
          "text": "An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations.\r\n\r\nAn attacker must have had physical access to the target system in order to exploit this vulnerability due to need to access a certain hardware component.\r\n\r\nAlso note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a previous WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-WFBSS-001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-23056",
          "url": "http://zerodayinitiative.com/advisories/published/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "May 2025 Monthly Release\n(6.7.3954 / 14.3.1299)",
          "product_ids": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "environmentalScore": 8.7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 8.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "title": "Uncontrolled Search Path Element Arbitrary Code Execution"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Nicolas Caluori working with Trend Zero Day Initiative"
          ],
          "summary": "Trend Micro would like to thank the following individuals for responsibly reporting these issues: Nicolas Caluori working with Trend Micro's Zero Day Initiative"
        }
      ],
      "cve": "CVE-2025-53378",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "description",
          "text": "A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to remotely take control of the agent on affected installations.\r\n\r\nAlso note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-WFBSS-001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-25342",
          "url": "http://zerodayinitiative.com/advisories/published/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "May 2025 Monthly Release\n(6.7.3954 / 14.3.1299)",
          "product_ids": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "environmentalScore": 8.7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 8.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-WFBSS-001"
          ]
        }
      ],
      "title": "Missing Authentication"
    }
  ]
}