Trend Micro Worry-Free Business Security uncontrolled search path

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Trend Micro Worry-Free Business Security. Affected is an unknown function. This manipulation causes uncontrolled search path. This vulnerability is registered as CVE-2025-49487. The attack needs to be launched locally. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Trend Micro Worry-Free Business Security (affected version unknown). Affected by this vulnerability is an unknown functionality. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in order to exploit this vulnerability due to need to access a certain hardware component. Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a previous WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.

It is possible to read the advisory at zerodayinitiative.com. This vulnerability is known as CVE-2025-49487 since 06/05/2025. The exploitation appears to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/09/2025). The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18526). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Trend Micro

Name

• Worry-Free Business Security

License

• commercial

Website

• Vendor: https://www.trendmicro.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion