CVE-2025-31284 Privilege escalation in Trend Vision One
Administrators could create users with elevated privileges due to broken access control in Trend Vision One, allowing privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-31284?
CVE-2025-31284 is a medium-severity vulnerability in Trend Vision One, published on 2 Apr 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Weakness: CWE-269
Which versions are affected by CVE-2025-31284?
It affects 1 product.
Products include Trendmicro Trend Vision One.
How do I fix CVE-2025-31284?
No fix has been published for CVE-2025-31284 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-31284 being exploited?
There is no known exploitation of CVE-2025-31284 in the wild and no public exploit code.
Other vulnerabilities in Trend Vision One
Sources
Also known as GHSA-xf8m-87xc-5cw5.