PT-2025-25263 · Trend Micro · Trend Micro Password Manager

Published 2025-01-14 · Updated 2025-08-27 · CVE-2025-48443

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below

Description The issue allows a local attacker to leverage a Link Following Local Privilege Escalation vulnerability to delete files in the context of an administrator when the administrator installs Trend Micro Password Manager.

Recommendations For Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below, update to a version above 5.0.0.1266 to resolve the issue.

Fix

LPE

Link Following

Weakness Enumeration

CWE-64

CWE-59

Related Identifiers

BDU:2025-08891

CVE-2025-48443

ZDI-25-361

Affected Products

Trend Micro Password Manager

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-48443 · Security Note
• https://helpcenter.trendmicro.com/en-us/article/TMKA-12917 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-361 · Security Note
• https://bdu.fstec.ru/vul/2025-08891 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48443 · Vendor Advisory
• https://helpcenter.trendmicro.com/en-us/article/tmka-12917 · Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-25574 · Note
• https://t.me/cvetracker/26459 · Telegram Post
• https://twitter.com/CVEnew/status/1935078719019958704 · Twitter Post
• https://twitter.com/transilienceai/status/1940623882773549333 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2025061233 · Note
• https://t.me/cveNotify/133640 · Telegram Post