CVE-2024-55955: 
Trend Micro Deep Security Agent vulnerability analysis and mitigation

An incorrect permissions assignment vulnerability was identified in Trend Micro Deep Security 20.0 agents, tracked as CVE-2024-55955. The vulnerability affects versions between 20.0.1-9400 and 20.0.1-23340 on Windows systems. This security issue was discovered by an anonymous researcher working with Trend Micro's Zero Day Initiative and was disclosed on December 19, 2024 (Trend Advisory).

The vulnerability is classified with a CVSSv3 score of 6.7 (MEDIUM) with the vector string AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. It is categorized under CWE-427: Uncontrolled Search Path Element. The specific flaw exists within the agent installer, where incorrect permissions are set on a product folder created by the installer (ZDI Advisory).

If successfully exploited, this vulnerability could allow an attacker to escalate privileges and execute arbitrary code in the context of an administrator at medium integrity. The attacker would need to first obtain the ability to execute low-privileged code on the target system (Trend Advisory).

Exploitation of this vulnerability requires that an attacker has access (physical or remote) to a vulnerable machine and the ability to execute low-privileged code. Additionally, subsequent user interaction on the part of an administrator is required (ZDI Advisory).

Trend Micro has released version 20.0.1-23340 (20 LTS Update 2024-11-13) to address this vulnerability. Customers are strongly encouraged to update to the latest build as soon as possible. Additionally, organizations should review remote access to critical systems and ensure policies and perimeter security are up-to-date (Trend Advisory).