PT-2023-23854 · Trend Micro · Trend Micro Mobile Security

Poh Jia Hao · Published 2023-05-12 · Updated 2024-08-23 · CVE-2023-32523

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Mobile Security (Enterprise) version 9.8 SP5 Trend Micro Mobile Security (Enterprise) versions 9.8 SP5 through versions prior to the application of Critical Patch 3

Description The issue allows a remote user to bypass authentication, potentially chaining with other vulnerabilities to achieve further exploitation. An attacker must first obtain the ability to execute low-privileged code on the target system. The vulnerability is related to widgets in the software that can be exploited for unauthenticated remote code execution.

Recommendations For Trend Micro Mobile Security (Enterprise) version 9.8 SP5, apply Critical Patch 3 to resolve the issue. For versions prior to the application of Critical Patch 3, update to a version that includes Critical Patch 3 or later to mitigate the risk. As a temporary workaround, consider restricting access to the widgets that allow authentication bypass until a patch is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-32523

ZDI-23-587

Affected Products

Trend Micro Mobile Security

References · 8

• https://osv.dev/vulnerability/CVE-2023-32523 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32523 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-587 · Security Note
• https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US · Vendor Advisory
• https://t.me/cvenotify/53085 · Telegram Post
• https://twitter.com/buaqbot/status/1827139049326313907 · Twitter Post
• https://t.me/cvenotify/53086 · Telegram Post
• https://t.me/cibsecurity/65550 · Telegram Post