CVE-2025-49215: trend micro SQL Injection — Fix

Description

A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.

Is your site exposed to CVE-2025-49215?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-242 CWE-242

CWE-89 SQL Injection

Affected Products

Vendor	Product	Versions
trendmicro	trend_micro_endpoint_encryption	< 6.0.0.4013
microsoft	windows	All

References

Advisories & Patches

https://success.trendmicro.com/en-US/solution/KA-0019928

Other References

https://www.zerodayinitiative.com/advisories/ZDI-25-372/

Frequently Asked Questions

What is CVE-2025-49215? +

A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2025-49215? +

CVE-2025-49215 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-49215? +

CVE-2025-49215 affects products from microsoft, trendmicro, specifically: trend_micro_endpoint_encryption, windows. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-49215? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-52324 9.8

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an …

CVE-2026-6477 8.8

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server …

CVE-2025-1994 7.8

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a local user to execute arbitrary code on the system due …

CVE-2025-1331 7.8

IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute …

CVE-2026-11980 7.3

IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.

CVE-2025-49219 9.8

An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution …

CVE-2025-49215