CVE-2022-40139

2022-09-1918:01:01

trendmicro

www.cve.org

8.1 High

AI Score

Confidence

High

0.014 Low

EPSS

Percentile

86.6%

JSON

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.

CNA Affected

[
  {
    "product": "Trend Micro Apex One",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "2019 (on-prem) and SaaS"
      }
    ]
  }
]