PT-2025-29145 · Trend Micro · Trend Micro Worry-Free Business Security Services

Nicolas Caluori · Published 2025-02-21 · Updated 2025-07-15 · CVE-2025-53378

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Trend Micro Worry-Free Business Security Services (WFBSS) agent (affected versions not specified)

Description: A missing authentication issue in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could allow an unauthenticated attacker to remotely take control of the agent on affected installations. This issue only affected the SaaS client version of WFBSS; the on-premise version of Worry-Free Business Security was not affected.

Recommendations: Ensure WFBSS agents are on the regular SaaS maintenance deployment schedule.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-08903

CVE-2025-53378

ZDI-25-589

Affected Products

Trend Micro Worry-Free Business Security Services

References · 8

• https://zerodayinitiative.com/advisories/ZDI-25-589 · Security Note
• https://success.trendmicro.com/en-US/solution/KA-0019936 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53378 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08903 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-53378 · Security Note
• https://twitter.com/CVEnew/status/1943668215416287368 · Twitter Post
• https://twitter.com/cracbot/status/1945075953132089355 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1943479385375322552 · Twitter Post