CVE-2025-49217 — Use of Obsolete Function in Micro INC Trend Micro Endpoint Encryption Policy Server

CWE-477 — Use of Obsolete FunctionCWE-502 — Deserialization of Untrusted Data3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
3.6%
top 12.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Trend Micro INC Trend Micro Endpoint Encryption Policy ServerTrendmicro Trend Micro Endpoint Encryption
Timeline
PublishedJun 17

Description

An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
CVE-2025-49217: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on↗2025-06-17
▶
GHSA
GHSA-qh4c-q793-rvmw: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on↗2025-06-17
▶
CVE-2025-49217 — Use of Obsolete Function | cvebase