Privilege escalation in Trendmicro Trend Vision One
CVE-2025-31285
A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Vulnerability class: Privilege Escalation
EPSS: 0.003 (17.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.6 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N.
Affected products
- Trendmicro Trend_vision_one
- Trend Micro, Inc. Vision One — versions NA
Weakness classification (CWE)
References
- security@trendmicro.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-31285?
- CVE-2025-31285 is a medium-severity vulnerability in Trendmicro Trend Vision One, classified under Improper Privilege Management. CVSS score: 4.6/10. Published 2025-04-02.
- How severe is CVE-2025-31285?
- Medium severity. CVSS v3 base score is 4.6 out of 10.