PT-2020-9583 · Trend Micro · Trend-Micro

Published 2020-02-20 · Updated 2020-03-04 · CVE-2019-14688

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Trend Micro products (affected versions not specified)

Description: The issue is related to a DLL hijack vulnerability in the install package used by several Trend Micro products. This vulnerability can be exploited during the initial installation of a product by an authorized user. The attacker must convince the target to download a malicious DLL locally, which must be present when the installer is run. The vulnerability is only exploitable during new product installations.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2019-14688

Affected Products

Trend-Micro

References · 5

• https://osv.dev/vulnerability/CVE-2019-14688 · Vendor Advisory
• https://success.trendmicro.com/solution/1123562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14688 · Security Note
• https://t.me/malwr/2452 · Telegram Post
• https://t.me/cvenotify/1123 · Telegram Post