CVE-2023-32554

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32555.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-325557.0A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escala CVE-2023-325565.5A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitiv CVE-2023-325579.8A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an ar CVE-2023-325587.5The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all u CVE-2023-325597.5A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use CVE-2023-32568.1Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files.CVE-2023-325609.8An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary co CVE-2023-325617.5A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentica CVE-2023-325629.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t CVE-2023-325639.8An unauthenticated attacker could achieve the code execution through a RemoteControl server.CVE-2023-325649.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t CVE-2023-325659.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. F