← Back

CVE-2025-49217

nvd nist
Published: Jun 17, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: security@trendmicro.com (Secondary)

Description

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method.

Affected (1)

Trendmicro
1 product
Trend Micro Endpoint Encryption
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Trend Micro Endpoint Encryption
Before 6.0.0.4013
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-477
Use of Obsolete Function
The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

Source: security@trendmicro.com
Vendor Advisory
Source: security@trendmicro.com
Third Party Advisory

Timeline

No history available yet.