CVE-2025-49154

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-491558.8An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject maliciou CVE-2025-491567.8A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected ins CVE-2025-491577.8A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on af CVE-2025-491587.8An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges o CVE-2025-49169.8A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been rated as critical. This issue affects some unknow CVE-2025-491626.4Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allo CVE-2025-491636.7Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.CVE-2025-491644.3Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f5 CVE-2025-49179.8A vulnerability classified as critical has been found in PHPGurukul Auto Taxi Stand Management System 1.0. Affected is an unknown function o CVE-2025-491756.1A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least o CVE-2025-491767.3A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, pote CVE-2025-491776.1A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client