CVE-2024-23940
📋 TL;DR
This vulnerability allows attackers to hijack DLL files used by Trend Micro's uiAirSupport component, enabling them to execute arbitrary code with elevated privileges. It affects Trend Micro Security 2023 consumer products running vulnerable versions. Successful exploitation could lead to full system compromise.
💻 Affected Systems
- Trend Micro Security 2023 family of consumer products
📦 What is this software?
Air Support by Trendmicro
Internet Security by Trendmicro
Maximum Security by Trendmicro
Premium Security by Trendmicro
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing installation of malware, data theft, and persistent backdoor access.
Likely Case
Local privilege escalation leading to unauthorized system access and potential lateral movement within the network.
If Mitigated
Limited impact with proper endpoint protection and user privilege restrictions in place.
🎯 Exploit Status
Exploitation requires local access and ability to place malicious DLL files in specific directories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.2093 or later
Vendor Advisory: https://helpcenter.trendmicro.com/en-us/article/tmka-12134
Restart Required: Yes
Instructions:
1. Open Trend Micro Security 2023. 2. Click 'Check for Updates'. 3. Install available updates. 4. Restart computer when prompted.
🔧 Temporary Workarounds
Restrict DLL loading permissions
windowsSet stricter permissions on directories where Trend Micro loads DLLs to prevent unauthorized file placement.
icacls "C:\Program Files\Trend Micro\Security\uiAirSupport" /deny Everyone:(OI)(CI)(RX)
🧯 If You Can't Patch
- Implement strict user privilege management to limit local access
- Deploy application whitelisting to prevent unauthorized DLL execution
🔍 How to Verify
Check if Vulnerable:
Check Trend Micro Security version in the application interface or via 'About' section.Check Version:
wmic product where "name like 'Trend Micro%'" get versionVerify Fix Applied:
Confirm version is 6.0.2093 or higher in Trend Micro Security interface.📡 Detection & Monitoring
Log Indicators:
- Unusual DLL loading from non-standard paths
- Process creation from Trend Micro directories with suspicious parent processes
Network Indicators:
- Outbound connections from Trend Micro processes to unexpected destinations
SIEM Query:
Process Creation where (Image contains 'Trend Micro' OR ParentImage contains 'Trend Micro') AND CommandLine contains '.dll'🔗 References
- https://helpcenter.trendmicro.com/en-us/article/tmka-12134
- https://helpcenter.trendmicro.com/ja-jp/article/tmka-12132
- https://medium.com/@s1kr10s/av-when-a-friend-becomes-an-enemy-55f41aba42b1
- https://helpcenter.trendmicro.com/en-us/article/tmka-12134
- https://helpcenter.trendmicro.com/ja-jp/article/tmka-12132
- https://medium.com/@s1kr10s/av-when-a-friend-becomes-an-enemy-55f41aba42b1
