← Back

CVE-2025-49214

nvd nist
Published: Jun 17, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: security@trendmicro.com (Secondary)

Description

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.

Affected (1)

Trendmicro
1 product
Trend Micro Endpoint Encryption
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Trend Micro Endpoint Encryption
Before 6.0.0.4013
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-477
Use of Obsolete Function
The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

Source: security@trendmicro.com
Vendor Advisory
Source: security@trendmicro.com
Third Party Advisory

Timeline

No history available yet.