⚠ Actively exploited
Added to CISA KEV on 2022-09-15. Federal agencies required to patch by 2022-10-06. Required action: Apply updates per vendor instructions..
CVE-2022-40139 — Missing Support for Integrity Check in Micro Apex ONE
Severity
7.2HIGHNVD
EPSS
8.9%
top 7.41%
CISA KEV
KEV
Added 2022-09-15
Due 2022-10-06
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
KEV addedSep 15
PublishedSep 19
Latest updateSep 20
KEV dueOct 6
CISA Required Action: Apply updates per vendor instructions.
Description
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9
Affected Packages2 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-6h63-j29f-rv95: Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allo↗2022-09-20
CVEList▶
CVE-2022-40139: Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allo↗2022-09-19