CVE-2024-58104 Details
Description
A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
A vulnerability exists in the Trend Micro Apex One Security Agent Plug-in User Interface Manager, allowing a local attacker to bypass security measures and execute arbitrary code on affected systems. This vulnerability affects Trend Micro Apex One 2019 (On-prem) versions prior to build 13140 and Apex One as a Service versions prior to 202412 (Agent version 14.0.14203). To exploit this vulnerability, an attacker must first gain the ability to execute low-privileged code on the target system.
Users are advised to update to Trend Micro Apex One SP1 build 13140 or to the December 2024 Monthly Maintenance (202412) for Apex One as a Service. These versions are now available.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://success.trendmicro.com/en-US/solution/KA-0018217 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| trendmicro apex one | < 14.0.14203 < 2019.13140 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2025 | Initial Analysis | [email protected] |
| Mar 25, 2025 | CVE Modified | CISA-ADP |
| Mar 25, 2025 | New CVE Received | [email protected] |