PT-2025-25273 · Trend Micro · Trend Micro Worry-Free Business Security Services

Will Dormann · Published 2025-06-11 · Updated 2025-06-17 · CVE-2025-49487

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Trend Micro Worry-Free Business Security Services (WFBSS) SaaS client version (affected versions not specified)

Description The issue is related to an uncontrolled search path vulnerability in the WFBSS agent, which could allow an attacker with physical access to a machine to execute arbitrary code on affected installations. The attacker must have physical access to the target system to exploit this vulnerability, as they need to access a certain hardware component. This vulnerability only affects the SaaS client version of WFBSS, and it has been addressed in a previous monthly maintenance update.

Recommendations For the Trend Micro Worry-Free Business Security Services (WFBSS) SaaS client version, ensure that the WFBSS agents are on the regular SaaS maintenance deployment schedule, as this issue was addressed in a previous update. No other customer action is required to mitigate this issue if the agents are up to date.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2026-01107

CVE-2025-49487

ZDI-25-360

Affected Products

Trend Micro Worry-Free Business Security Services

References · 7

• https://bdu.fstec.ru/vul/2026-01107 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-360 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49487 · Vendor Advisory
• https://success.trendmicro.com/en-US/solution/KA-0019936 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49487 · Security Note
• https://twitter.com/CVEnew/status/1935053117088805234 · Twitter Post
• https://t.me/cvetracker/26446 · Telegram Post