CVE-2023-41179
Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
Description
CVE-2023-41179 is a code injection vulnerability in the third-party antivirus uninstaller module bundled with Trend Micro Apex One (both on-premises and SaaS), Worry-Free Business Security, and Worry-Free Business Security Services. The flaw allows an attacker with administrative console access to manipulate the AV uninstaller module to execute arbitrary commands on the affected system. CISA has added CVE-2023-41179 to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 12, 2023, confirming active exploitation in the wild. With a CVSS score of 7.2 (High) and an EPSS score of 2.31% (84.52nd percentile), this Trend Micro command execution vulnerability requires immediate attention from organizations running these security products.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trendmicro | apex one | 2019 |
| trendmicro | worry-free business security | 10.0 |
| trendmicro | worry-free business security services | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://jvn.jp/en/vu/JVNVU90967486/(Third Party Advisory)
- https://success.trendmicro.com/jp/solution/000294706(Broken Link)
- https://success.trendmicro.com/solution/000294994(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41179(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-94 describes a weakness where software constructs code segments using externally-influenced input without properly neutralizing special elements that could alter the intended code syntax or behavior. In CVE-2023-41179, this manifests within the third-party AV uninstaller module in Trend Micro products, where an attacker with administrative access can inject and execute arbitrary commands through the module's processing logic.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2023-41179 carries a CVSS v3.1 score of 7.2 (High severity), reflecting a significant command execution risk within enterprise security products. Attack Vector (Network): The vulnerability is remotely exploitable through the administrative console, which is typically network-accessible. Attack Complexity (Low): Once administrative console access is obtained, exploitation is straightforward with no special conditions required. Privileges Required (High): The attacker must first obtain administrative console access to the Trend Micro management interface, which limits the pool of potential attackers but does not eliminate the risk — compromised admin credentials or insider threats remain viable attack paths. User Interaction (None): No action from other users is needed for exploitation. Confidentiality, Integrity, and Availability (all High): Successful exploitation allows arbitrary command execution on the target system, potentially granting the attacker full control over the security product and the underlying server, including access to sensitive security telemetry, modification of security policies, and complete disruption of endpoint protection services. The irony of a security product itself being the attack vector amplifies the risk, as compromising Apex One or Worry-Free Business Security could disable the very defenses designed to protect the organization.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-41179 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of October 12, 2023. The EPSS score of 2.31% (84.52nd percentile) indicates a moderate-to-high probability of exploitation, consistent with the confirmed in-the-wild activity. While the available references do not include tagged public exploit code or proof-of-concept, the confirmed active exploitation demonstrates that threat actors have already developed working exploits for this Trend Micro vulnerability. The requirement for administrative console access somewhat limits the attack surface, but compromised credentials or lateral movement within a network could provide the necessary access.
Remediation
- Apply Trend Micro patches immediately. Install the latest security updates for Apex One (on-premises and SaaS), Worry-Free Business Security, and Worry-Free Business Security Services as directed by Trend Micro's security advisories. CISA's KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Restrict administrative console access. Limit access to Trend Micro management consoles to authorized personnel only. Implement network-level restrictions (IP allowlisting, VPN requirements) to prevent unauthorized access to the administrative interface. Enable multi-factor authentication (MFA) for all admin accounts.
- Audit administrative credentials. Immediately rotate all administrative passwords for Trend Micro consoles. Review access logs for any unauthorized login attempts or suspicious administrative actions. Remove unnecessary admin accounts and enforce strong password policies.
- Monitor for indicators of compromise. Review Trend Micro console logs for unusual uninstaller module activity, unexpected command execution, or unauthorized configuration changes. Deploy additional monitoring on servers running Apex One or Worry-Free Business Security to detect anomalous process behavior.
- Implement network segmentation. Isolate Trend Micro management servers on a dedicated management VLAN with strict access controls. This limits the blast radius if the administrative console is compromised and prevents lateral movement from exploiting CVE-2023-41179.
Technical Details
CVE-2023-41179 is classified under CWE-94 (Improper Control of Generation of Code), where the third-party AV uninstaller module within Trend Micro's security products fails to properly sanitize or validate input before constructing executable commands. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H) — specifically, administrative console access to the Trend Micro management interface. No user interaction is needed (UI:N), and the scope remains unchanged (S:U), meaning the exploit's impact is confined to the vulnerable component and its hosting system. All three impact metrics are rated High (C:H/I:H/A:H), as successful code injection through the AV uninstaller module can grant the attacker arbitrary command execution with the privileges of the Trend Micro service, which typically runs with elevated system-level permissions. The attack chain requires the adversary to first compromise or possess valid administrative credentials, then leverage the uninstaller module's code injection flaw to execute commands on the underlying operating system.
Frequently Asked Questions
Is CVE-2023-41179 being actively exploited?
Yes. CISA has added CVE-2023-41179 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of October 12, 2023. The ransomware association is currently listed as unknown. Organizations running Trend Micro Apex One or Worry-Free Business Security should treat this as an urgent security issue.
What products are affected by CVE-2023-41179?
CVE-2023-41179 affects Trend Micro Apex One (both on-premises and SaaS deployments), Trend Micro Worry-Free Business Security, and Trend Micro Worry-Free Business Security Services. The vulnerability is in the third-party AV uninstaller module that is bundled with these products.
How do I fix CVE-2023-41179?
Apply the latest security patches from Trend Micro for Apex One, Worry-Free Business Security, and Worry-Free Business Security Services. Additionally, restrict access to administrative consoles, enable MFA for admin accounts, and rotate all administrative credentials. See the Remediation section for detailed steps.
How severe is CVE-2023-41179?
CVE-2023-41179 is rated High severity with a CVSS v3.1 score of 7.2 out of 10. The EPSS score of 2.31% places it in the 84.52nd percentile. While exploitation requires administrative console access, the confirmed active exploitation and the potential for full system compromise through a security product make this a high-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.