PT-2022-4843 · Trend Micro · Trend Micro Apex One As A Service+1

Published

2022-09-06

·

Updated

2026-05-25

·

CVE-2022-40139

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Trend Micro Apex One and Trend Micro Apex One as a Service (affected versions not specified)
Description The issue is related to improper validation of components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients. This could allow an attacker with Apex One server administration console access to instruct affected clients to download an unverified rollback package, potentially leading to remote code execution. The attacker must first obtain Apex One server administration console access to exploit this issue.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-20CWE-345

Related Identifiers

BDU:2022-05903
CVE-2022-40139

Affected Products

Trend Micro Apex One
Trend Micro Apex One As A Service