Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2025-53378

Severity CVSS v4.0:
Pending analysis
Type:
CWE-306 Missing Authentication for Critical Function
Publication date:
10/07/2025
Last modified:
03/10/2025

Description

A missing authentication vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an unauthenticated attacker to remotely take control of the agent on affected installations.<br /> <br /> Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.

Impact

Vector 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H CVSS v3.1 Severity and Metrics:

Base Score: 7.60 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope (S): Unchanged
Confidentiality (C): Low
Integrity (I): Low
Availability (A): High

Base Score 3.x
7.60
Severity 3.x
HIGH

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:trendmicro:worry-free_business_security_services:*:*:*:*:saas:*:*:* 6.7.0.0 (including) 6.7.3954 (excluding)
cpe:2.3:a:trendmicro:worry-free_business_security_services:*:*:*:*:saas:*:*:* 14.0.0 (including) 14.3.1299 (excluding)
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools