« Volver al listado

CVE-2019-15628

Estado: ModificadaAlta (7.8)—

Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specific service as an execution and/or persistence mechanism which could execute a malicious program each time the service is started.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Trendmicro — Antivirus + Security 2020Trendmicro — Internet Security 2020Trendmicro — Maximum Security 2020Trendmicro — Premium Security 2020

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-15628",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Trend Micro",
          "product": "Trend Micro Security (Consumer)",
          "versions": [
            {
              "status": "affected",
              "version": "Version 2020 (16.0.1221 and below)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-12-02T16:15:12.127",
  "references": [
    {
      "url": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124011.aspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "https://safebreach.com/Post/Trend-Micro-Security-16-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-15628",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124011.aspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://safebreach.com/Post/Trend-Micro-Security-16-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-15628",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specific service as an execution and/or persistence mechanism which could execute a malicious program each time the service is started."
    },
    {
      "lang": "es",
      "value": "Trend Micro Security (Consumer) 2020 (versiones v16.0.1221 y posteriores), está afectado por una vulnerabilidad de secuestro de DLL que podría permitir a un atacante usar un servicio específico como un mecanismo de ejecución y/o persistencia que podría ejecutar un programa malicioso cada vez que el servicio sea iniciado."
    }
  ],
  "lastModified": "2026-06-17T02:20:46.663",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trendmicro:antivirus_\\+_security_2020:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A62D8CA-DB54-4605-8FCE-A50962C30BB3",
              "versionEndIncluding": "16.0.1221"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:internet_security_2020:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03E2F883-D77A-4F62-BCB7-755FCF9100ED",
              "versionEndIncluding": "16.0.1221"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:maximum_security_2020:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBA47DE9-6F39-48D3-8C95-2327E85639AB",
              "versionEndIncluding": "16.0.1221"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:premium_security_2020:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A837FE6-2D7B-4DF0-A905-5DE2F3E569DD",
              "versionEndIncluding": "16.0.1221"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@trendmicro.com"
}