CVE-2022-40139

Katalog CVE

CVSS 7.2 · High KEV · sudah dieksploitasi EPSS 3,3%

Kerentanan pada trendmicro apex one. Skor CVSS 3.1 7.2 (High) menurut NVD. Masuk katalog KEV CISA pada 15 September 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.

Rincian

Terbit di NVD

19 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

3,3% peluang dieksploitasi; lebih tinggi dari 88,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability

Masuk KEV

15 September 2022

Tenggat CISA

6 Oktober 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://success.trendmicro.com/solution/000291528 patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40139 pemerintah AS