CVE-2022-28394
📋 TL;DR
This vulnerability in Trend Micro Password Manager installer versions 3.7.0.1223 and below allows attackers to execute arbitrary code by placing malicious DLLs in locations the installer searches. It affects users running outdated, end-of-life versions of the consumer password manager software.
💻 Affected Systems
- Trend Micro Password Manager (Consumer)
📦 What is this software?
Password Manager by Trendmicro
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining administrative privileges and complete control over the affected system.
Likely Case
Local privilege escalation allowing attackers to install malware, steal credentials, or persist on the system.
If Mitigated
Limited impact if proper file permissions and execution controls prevent DLL planting in vulnerable directories.
🎯 Exploit Status
Requires local access to plant malicious DLLs in directories searched by the installer.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.x (latest supported version)
Vendor Advisory: https://helpcenter.trendmicro.com/ja-jp/article/TMKA-10977
Restart Required: Yes
Instructions:
1. Uninstall affected version (3.7.0.1223 or below)
2. Download latest version 5.x from Trend Micro website
3. Install new version
4. Restart system
🔧 Temporary Workarounds
Restrict DLL search path permissions
windowsSet strict permissions on directories the installer searches to prevent unauthorized DLL placement
icacls "C:\Program Files\Trend Micro\Password Manager" /deny Everyone:(OI)(CI)W
🧯 If You Can't Patch
- Uninstall Trend Micro Password Manager completely
- Use alternative password manager software
🔍 How to Verify
Check if Vulnerable:
Check installed version in Control Panel > Programs and Features. If version is 3.7.0.1223 or below, system is vulnerable.Check Version:
wmic product where "name like 'Trend Micro Password Manager%'" get versionVerify Fix Applied:
Verify version is 5.x or higher in installed programs list and check that installer directory permissions are properly restricted.📡 Detection & Monitoring
Log Indicators:
- Failed DLL loading attempts from Password Manager installer
- Unusual process creation from Password Manager directory
Network Indicators:
- None - local exploitation only
SIEM Query:
Process Creation where Image contains 'Password Manager' and CommandLine contains 'install' or 'setup'