Trend Micro Password Manager Link Following Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in Trend Micro Password Manager (Consumer) versions 5.0.0.1266 and prior. This vulnerability allows a local attacker to delete files with administrative privileges when the administrator installs the application. The issue arises from the product installer, which can be manipulated to remove arbitrary files, potentially leading to unauthorized privilege escalation and execution of arbitrary code in the context of the SYSTEM user.

Impact

Exploitation of this vulnerability could allow local attackers to escalate privileges and execute arbitrary code with SYSTEM rights on the affected machine.

Remediation

Users are advised to update to Trend Micro Password Manager version 5.8.0.1330. The update is available through the product's automatic update mechanism. For new installations, the latest version can be downloaded from the Trend Micro Password Manager download page.