CVE-2023-47192

View on CVE.org

Published Jan 23, 2024 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Trend Micro, Inc.

Trend Micro Apex One

affected

Version	Status	Constraints
`2019 (14.0)`	affected	< 14.0.0.12526

Trend Micro, Inc.

Trend Micro Apex One as a Service

affected

Version	Status	Constraints
`SaaS`	affected	< 14.0.12737

Configuration 1 [-]

OR	cpe:2.3:a:trendmicro:apex_one:::::saas:windows::
	cpe:2.3:a:trendmicro:apex_one:2019::::on-premises:windows::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.235% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US
https://www.zerodayinitiative.com/advisories/ZDI-23-1611/

History

Nov 13, 2024 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Trendmicro Apex One

Weaknesses

CWE-59

Sources

CVE record Updated: Jun 17, 2025, 4:13 PM

Status: PUBLISHED
Assigner: trendmicro
Published: Jan 23, 2024, 8:36 PM
Updated: Jun 17, 2025, 4:13 PM
Reserved: Oct 31, 2023, 7:20 PM

View source JSON

Vulnrichment Updated: Aug 2, 2024, 9:01 PM

Updated: Aug 2, 2024, 9:01 PM

NVD Updated: Jun 17, 2026, 6:32 AM

Status: Modified
Published: Jan 23, 2024, 9:15 PM
Modified: Jun 17, 2026, 6:32 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-47192", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "state": "PUBLISHED", "assignerShortName": "trendmicro", "dateReserved": "2023-10-31T19:20:53.843Z", "datePublished": "2024-01-23T20:36:34.790Z", "dateUpdated": "2025-06-17T16:13:44.095Z"}, "containers": {"cna": {"affected": [{"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One", "versions": [{"version": "2019 (14.0)", "status": "affected", "versionType": "semver", "lessThan": "14.0.0.12526"}]}, {"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One as a Service", "versions": [{"version": "SaaS\t", "status": "affected", "versionType": "semver", "lessThan": "14.0.12737"}]}], "descriptions": [{"lang": "en", "value": "An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.\r\n\r\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability."}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2024-01-23T20:36:34.790Z"}, "references": [{"url": "https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1611/"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:01:22.811Z"}, "title": "CVE Program Container", "references": [{"url": "https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US", "tags": ["x_transferred"]}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1611/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-59", "lang": "en", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-11-13T15:46:14.411691Z", "id": "CVE-2023-47192", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T16:13:44.095Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US", "tags": ["x_transferred"]}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1611/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:01:22.811Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-47192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-13T15:46:14.411691Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-13T15:47:01.429Z"}}], "cna": {"affected": [{"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One", "versions": [{"status": "affected", "version": "2019 (14.0)", "lessThan": "14.0.0.12526", "versionType": "semver"}]}, {"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One as a Service", "versions": [{"status": "affected", "version": "SaaS\t", "lessThan": "14.0.12737", "versionType": "semver"}]}], "references": [{"url": "https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1611/"}], "descriptions": [{"lang": "en", "value": "An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.\r\n\r\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability."}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2024-01-23T20:36:34.790Z"}}}, "cveMetadata": {"cveId": "CVE-2023-47192", "state": "PUBLISHED", "dateUpdated": "2025-06-17T16:13:44.095Z", "dateReserved": "2023-10-31T19:20:53.843Z", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "datePublished": "2024-01-23T20:36:34.790Z", "assignerShortName": "trendmicro"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Trend Micro Apex One", "vendor": "Trend Micro, Inc.", "versions": [{"lessThan": "14.0.0.12526", "status": "affected", "version": "2019 (14.0)", "versionType": "semver"}]}, {"product": "Trend Micro Apex One as a Service", "vendor": "Trend Micro, Inc.", "versions": [{"lessThan": "14.0.12737", "status": "affected", "version": "SaaS\t", "versionType": "semver"}]}], "source": "security@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:windows:*:*", "matchCriteriaId": "5D414F00-6C14-47B3-9858-3AE458F9289D", "versionEndExcluding": "14.0.12737", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:on-premises:windows:*:*", "matchCriteriaId": "84F26044-A0BB-442E-93BD-E836B4DD71F4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.\r\n\r\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad de enlace de agente en el agente de seguridad Trend Micro Apex One podr\u00eda permitir que un atacante local escale privilegios en las instalaciones afectadas. Tenga en cuenta: un atacante primero debe obtener la capacidad de ejecutar c\u00f3digo con pocos privilegios en el sistema de destino para poder explotar esta vulnerabilidad."}], "id": "CVE-2023-47192", "lastModified": "2026-06-17T06:32:19.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-47192", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-13T15:46:14.411691Z", "version": "2.0.3"}}]}, "published": "2024-01-23T21:15:08.520", "references": [{"source": "security@trendmicro.com", "tags": ["Vendor Advisory"], "url": "https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US"}, {"source": "security@trendmicro.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1611/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://success.trendmicro.com/dcx/s/solution/000295652?language=en_US"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1611/"}], "sourceIdentifier": "security@trendmicro.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-59"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}