{"id":"CVE-2023-41179","kind":"vulnerability","aliases":["CVE-2023-41179"],"related":[],"title":"A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS),…","description":"Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Trend Micro Apex One and Worry-Free Business Security have an unspecified flaw in their third-party anti-virus uninstaller module. An attacker with administrative console access can manipulate that module to run code remotely.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2023-09-21T00:00:00+00:00","products":[{"name":"Trend Micro Apex One and Worry-Free Business Security","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"trendmicro apex one","fixed":[],"affected":"= 2019","ecosystem":"vendor"},{"name":"trendmicro worry-free business security","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"trendmicro worry-free business security services","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apex-one","exploited","trend-micro","vendor","windows","worry-free-business-security"],"not_affected_if":["no-admin-console-exposure"],"how_to_check":null,"fix":"Apply the mitigations from the Trend Micro advisory, or discontinue use of the product if no mitigation is available (per CISA KEV required action).","status":"open","published_at":"2023-09-19T14:15:21+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:35+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:04:35Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from the Trend Micro advisory, or discontinue use of the product if no mitigation is available (per CISA KEV required action).","reach":"network","impact":"high","summary":"Trend Micro Apex One and Worry-Free Business Security have an unspecified flaw in their third-party anti-virus uninstaller module. An attacker with administrative console access can manipulate that module to run code remotely.","category":"vendor","who_cares":["trend-micro","apex-one","worry-free-business-security","windows"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with console admin access runs code on the security server.","analyst_note":"Find the Trend Micro advisory and the patched build numbers for Apex One and Worry-Free Business Security; the KEV entry alone gives no version or check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-admin-console-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000471,"input_tokens":2902,"output_tokens":362,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':22A,25A '-41179':23A,26A '3rd':5A 'access':96B,149C 'action':162C 'administr':94B,147C 'allow':130C 'and':31A 'anti':87B,125C 'anti-virus':86B,124C 'apex':14A,29A,38A,54B,69B,107C 'apex-on':53B 'appli':163C 'attack':92B,132C,143C 'av':7A 'busi':65B,75B,113C 'business':35A,44A,50A 'cisa':160C 'code':103B,140C 'conduct':138C 'consol':95B,148C 'contain':10A,115C 'could':129C 'cve':21A,24A 'discontinu':169C 'execut':141C 'exploit':56B,157C 'first':145C 'flaw':80B 'free':34A,43A,49A,64B,74B,112C 'instruct':167C 'manipul':98B,134C 'micro':13A,28A,59B,68B,106C 'mitig':164C,175C 'modul':9A,90B,100B,136C 'must':144C 'obtain':146C 'on-prem':16A 'one':15A,30A,39A,55B,70B,108C 'order':155C 'parti':6A,85B,123C 'per':165C 'prem':18A 'product':173C 'remot':104B,139C 'requir':161C 'run':102B 'saa':20A 'secur':66B,76B,114C 'security':36A,45A,51A 'services':52A 'system':153C 'target':152C 'third':84B,122C 'third-parti':83B,121C 'trend':12A,27A,58B,67B,105C 'trend-micro':57B 'trendmicro':37A,40A,46A 'unavail':177C 'uninstal':8A,89B,127C 'unspecifi':79B,117C 'use':170C 'vendor':60B,166C 'virus':88B,126C 'vulner':2A,118C,159C 'window':61B 'worri':63B,73B,111C 'worry':33A,42A,48A 'worry-fre':72B,110C 'worry-free':32A,41A,47A 'worry-free-business-secur':62B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-09-19T14:15:21+00:00","kev":{"dateAdded":"2023-09-21","dueDate":"2023-10-12","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-41179","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-41179","severity":null,"published_at":"2023-09-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-41179","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41179","severity":null,"published_at":"2023-09-19T14:15:21+00:00","modified_at":"2026-06-17T06:20:55+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}