CVE-2023-34146
📋 TL;DR
This vulnerability in Trend Micro Apex One and Apex One as a Service allows a local attacker with low-privileged code execution to escalate privileges and write arbitrary values to specific Trend Micro agent registry subkeys. It affects installations of these security products where an attacker has already gained initial access to the system.
💻 Affected Systems
- Trend Micro Apex One
- Trend Micro Apex One as a Service
📦 What is this software?
Apex One by Trendmicro
Apex One by Trendmicro
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through privilege escalation leading to complete administrative control, persistence mechanisms, and potential lateral movement across the network.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install additional malware, or modify system configurations to maintain persistence.
If Mitigated
Limited impact due to proper access controls preventing initial low-privileged code execution and network segmentation limiting lateral movement.
🎯 Exploit Status
Requires local access and low-privileged code execution first. Similar to CVE-2023-34147 and CVE-2023-34148 but not identical.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://success.trendmicro.com/dcx/s/solution/000293322?language=en_US
Restart Required: Yes
Instructions:
1. Review Trend Micro advisory 000293322. 2. Update Apex One agent to latest version. 3. Restart affected systems. 4. Verify patch installation.
🔧 Temporary Workarounds
Restrict local user privileges
windowsImplement least privilege principle to prevent initial low-privileged code execution
Registry permissions hardening
windowsRestrict write access to Trend Micro registry keys to trusted users only
reg add "HKLM\SOFTWARE\TrendMicro\Apex One" /v "Permissions" /t REG_SZ /d "Administrators:F" /f
🧯 If You Can't Patch
- Implement strict endpoint security controls to prevent initial low-privileged code execution
- Monitor for suspicious registry modifications to Trend Micro keys and investigate any unauthorized changes
🔍 How to Verify
Check if Vulnerable:
Check Apex One agent version against patched versions in Trend Micro advisory 000293322Check Version:
Check Apex One console or agent properties for version informationVerify Fix Applied:
Verify agent version is updated to patched version and monitor for successful agent restarts📡 Detection & Monitoring
Log Indicators:
- Unauthorized registry modifications to HKLM\SOFTWARE\TrendMicro keys
- Unexpected privilege escalation events
- Apex One agent service restarts or failures
Network Indicators:
- Unusual outbound connections from Apex One agent processes
- Lateral movement attempts from previously compromised systems
SIEM Query:
EventID=4657 OR EventID=4663 AND TargetObject:"*TrendMicro*" AND AccessMask:0x2