CVE-2023-41179

What it actually does

This is a command injection vulnerability in the third-party antivirus uninstaller module used by Trend Micro Apex One, Worry-Free Business Security, and Worry-Free Business Security Services on Windows. An attacker who already has administrative access to the product management console can manipulate uninstaller functionality so that attacker-controlled input is interpreted as operating system commands. Successful exploitation results in arbitrary command execution on the affected installation with the privileges of the Trend Micro service or application component handling the request, potentially allowing full compromise of the security management server or endpoint-management environment.

Why it matters to the business

Because these products are security-management platforms, compromise can have outsized operational impact: an attacker with console administrator access may turn the security tool itself into a command-execution mechanism, disable protections, deploy additional malware, tamper with managed endpoint settings, steal sensitive administrative data, or pivot further into the Windows environment. This vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2023-10-12, so unpatched systems should be treated as a high-priority exposure even though exploitation requires privileged console access.

How an attack unfolds

An attacker first obtains administrative access to the Trend Micro management console, commonly through stolen credentials, session hijacking, phishing, password reuse, exposed administrative interfaces, or compromise of an administrator workstation. After authenticating, the attacker accesses functionality related to the third-party antivirus uninstaller module and supplies crafted input containing operating system command syntax. The vulnerable module fails to safely validate or separate data from commands, causing the underlying Windows host to execute the injected command. The attacker can then run discovery commands, create persistence, download tooling, disable security controls, collect credentials, or use the compromised management server to influence managed endpoints. Public reporting and KEV status indicate this vulnerability has been exploited in the wild, so investigations should focus not only on patch state but also on suspicious administrative console activity and unexpected child processes launched by Trend Micro server components.

How to fix it

Apply the vendor-provided Trend Micro security update, patch, hotfix, or SaaS maintenance release that addresses CVE-2023-41179 for every affected Apex One, Worry-Free Business Security, and Worry-Free Business Security Services deployment. If exact fixed versions are not already tracked internally, verify current fixed builds directly against the relevant Trend Micro advisory for the deployed product and branch. For SaaS offerings, confirm the service tenant has received the vendor-side fix and that any local agents, relays, or on-premises components are also updated. Restrict management-console access to trusted administrative networks, enforce MFA for console administrators where supported, remove unnecessary administrator accounts, rotate potentially exposed credentials, and review role assignments. If immediate patching is not possible, limit access to the administrative console using VPN, firewall allowlists, identity-aware access controls, and privileged-access workflows; monitor administrative actions closely until remediation is complete.

How to confirm the fix worked

Confirm the installed Trend Micro product build and patch level are at or above the vendor-fixed release for the deployed branch. Validate that all on-premises management servers, security servers, and related Windows components have been updated, not only endpoint agents. For SaaS deployments, confirm through the administrative console or vendor support that the tenant-side service has received the fix. Test exposure by verifying that the management console is not reachable from untrusted networks and that only expected administrative users can authenticate. Review product logs and Windows event logs after patching to ensure no new suspicious command execution occurs from Trend Micro service processes. Where feasible, use vulnerability scanning, authenticated software inventory, or vendor-provided diagnostic tools to confirm the vulnerable module version is no longer present.

Typical attack path

1. Obtain administrative access to the affected Trend Micro management console through credential theft, phishing, password reuse, or prior compromise.
2. Authenticate to the Apex One or Worry-Free Business Security administrative interface.
3. Navigate to or invoke functionality that uses the third-party antivirus uninstaller module.
4. Submit crafted parameters containing command metacharacters or command payloads.
5. Cause the Trend Micro component to execute arbitrary Windows commands with service-level privileges.
6. Run reconnaissance commands, download additional payloads, create users or scheduled tasks, or alter security policies.
7. Use the compromised security-management infrastructure to maintain persistence, suppress detection, or pivot to managed Windows systems.

How to detect it

Investigate whether the Trend Micro management console was accessed by unusual users, from unusual source IP addresses, or outside normal administrative windows. Review Trend Micro administrative audit logs, product server logs, IIS or web access logs if the console is hosted through IIS, Windows Security event logs, Windows System logs, PowerShell logs, Sysmon or EDR telemetry, and proxy/DNS logs from the management server. Focus on evidence of the uninstaller module being invoked followed by operating-system command execution. Look for Windows process creation events where Trend Micro server or service processes spawn command interpreters or living-off-the-land binaries. Relevant Windows events include 4624/4625 for logon activity, 4672 for privileged logon, 4688 for process creation if enabled, 4697 for service installation, 4698 for scheduled task creation, 4720/4728/4732 for account and group changes, 7045 in System logs for new service creation, and PowerShell event IDs 4103/4104 for script block or module activity. Also search for suspicious downloads, encoded PowerShell, web shells or tooling written under temporary directories, new local administrators, unexpected scheduled tasks, disabled security services, and abnormal outbound connections from the Trend Micro management server. Because exploitation requires console administrator access, correlate command execution with console login records and administrative actions around the same timestamp.

• OfcService.exe spawning cmd.exe
• OfcService.exe spawning powershell.exe
• OfcService.exe spawning wscript.exe
• OfcService.exe spawning cscript.exe
• OfcService.exe spawning mshta.exe
• OfcService.exe spawning certutil.exe
• OfcService.exe spawning bitsadmin.exe
• OfcService.exe spawning rundll32.exe
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• Event ID 4688
• Event ID 7045
• Event ID 4698
• Event ID 4104
• C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Log\
• C:\Program Files\Trend Micro\OfficeScan\PCCSRV\Log\
• C:\Program Files (x86)\Trend Micro\Security Server\PCCSRV\Log\
• C:\Windows\Temp\
• C:\ProgramData\Trend Micro\

What your security team should do

• Treat unpatched affected systems as urgent because the vulnerability is in CISA KEV and has confirmed exploitation in the wild; the CISA remediation deadline of 2023-10-12 has already passed.
• Patch or hotfix all affected Trend Micro Apex One and Worry-Free Business Security deployments, prioritizing internet-exposed or broadly reachable management consoles.
• Audit all Trend Micro console administrator accounts, remove stale accounts, enforce MFA where possible, and rotate passwords or API credentials for privileged users.
• Restrict administrative console access to trusted networks and block direct internet exposure unless protected by strong access controls.
• Hunt for suspicious child processes launched by Trend Micro services, especially cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, certutil.exe, bitsadmin.exe, curl.exe, or rundll32.exe.
• Review administrative console logs for unusual login sources, failed login bursts, new administrator creation, policy changes, uninstaller activity, and actions outside normal maintenance windows.
• If exploitation is suspected, isolate the management server, preserve logs and forensic artifacts, rotate privileged credentials, and assess whether managed endpoints received malicious policy or command changes.
• Add detections for command execution spawned from Trend Micro installation directories or service accounts and escalate any hits for incident response review.