PT-2023-23855 · Trend Micro · Trend Micro Mobile Security

Poh Jia Hao · Published 2023-05-12 · Updated 2023-06-30 · CVE-2023-32524

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Mobile Security (Enterprise) version 9.8 SP5

Description The issue allows a remote user to bypass authentication, potentially chaining with other vulnerabilities. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue.

Recommendations For Trend Micro Mobile Security (Enterprise) version 9.8 SP5, consider restricting access to the widgets that allow authentication bypass until a patch is available. As a temporary workaround, review and strengthen the overall system security to prevent low-privileged code execution on the target system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-32524

ZDI-23-588

Affected Products

Trend Micro Mobile Security

References · 7

• https://zerodayinitiative.com/advisories/ZDI-23-588 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32524 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32524 · Security Note
• https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US · Vendor Advisory
• https://t.me/cvenotify/53085 · Telegram Post
• https://t.me/cvenotify/53086 · Telegram Post
• https://t.me/cibsecurity/65550 · Telegram Post