CVE-2022-23120: A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to…

PriorityP349high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

6.38%

92.8th percentile

A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to escalate privileges and run arbitrary code in the context of root. Please note: an attacker must first obtain access to the target agent in an un-activated and unconfigured state in order to exploit this vulnerability.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
trend_micro	trend_micro_deep_security_agent_for_linux	—	—
trendmicro	deep_security_agent	—	—
trendmicro	deep_security_agent	—	—
trendmicro	deep_security_agent	—	—
trendmicro	deep_security_agent	>= 20.0 < 20.0.0-3445	20.0.0-3445

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.