← Vulnerability feed

Vulnerability record · CVE-2017-5565 · published 21 March 2017

CVE-2017-5565: Trendmicro antivirus\+ uncontrolled search path element vulnerability

Trendmicro · Antivirus\+

Code injection vulnerability in Trend Micro Maximum Security 11.0 (and earlier), Internet Security 11.0 (and earlier), and Antivirus+ Security 11.0 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Trend Micro process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.

6.7 CVSS 3.0 Medium EPSS 0.70% · top 48.9% CWE-427 · Uncontrolled search path element
6.7CVSS 3.0 base score, v2 7.2
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
4Affected product versions listed by NVD
9References
17 Jun 2026Last modified by NVD

Description

Code injection vulnerability in Trend Micro Maximum Security 11.0 (and earlier), Internet Security 11.0 (and earlier), and Antivirus+ Security 11.0 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Trend Micro process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://cybellum.com/doubleagent-taking-full-control-antivirus/ Third Party Advisory
http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/ Technical DescriptionThird Party Advisory
http://www.securityfocus.com/bid/97031 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038206
https://success.trendmicro.com/solution/1116957 Vendor Advisory
http://cybellum.com/doubleagent-taking-full-control-antivirus/ Third Party Advisory
http://cybellum.com/doubleagentzero-day-code-injection-and-persistence-technique/ Technical DescriptionThird Party Advisory
http://www.securityfocus.com/bid/97031 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038206

Track CVE-2017-5565 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-3608Trendmicro antivirus \+ security code injection vulnerabilityA vulnerability in Trend Micro Maximum Security's (Consumer) 2018 (versions 12.0.1191 and below) User-Mode Hooking (UMH) driver could allow an attack…EPSS 3.4%9.3CVE-2010-3189Trendmicro internet security code injection vulnerabilityThe extSetOwner function in the UfProxyBrowserCtrl ActiveX control (UfPBCtrl.dll) in Trend Micro Internet Security Pro 2010 allows remote attackers t…EPSS 39%7.8CVE-2024-23940Trendmicro air support uncontrolled search path element vulnerabilityTrend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable to a DLL hi…EPSS 0.64%7.8CVE-2018-18333Trendmicro antivirus \+ security untrusted search path vulnerabilityA DLL hijacking vulnerability in Trend Micro Security 2019 (Consumer) versions below 15.0.0.1163 and below could allow an attacker to manipulate a sp…EPSS 1.8%7.8CVE-2018-10513Trendmicro antivirus \+ security deserialization of untrusted data vulnerabilityA Deserialization of Untrusted Data Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker …EPSS 0.76%7.8CVE-2018-10514Trendmicro antivirus \+ security improper privilege management vulnerabilityA Missing Impersonation Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate …EPSS 0.41%7.8CVE-2018-15363Trendmicro antivirus \+ security out-of-bounds read vulnerabilityAn Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate pr…EPSS 0.47%7.8CVE-2018-6232Trendmicro antivirus\+ classic buffer overflow vulnerabilityA buffer overflow privilege escalation vulnerability in Trend Micro Maximum Security (Consumer) 2018 could allow a local attacker to escalate privile…EPSS 0.50%

Source: NIST National Vulnerability Database (record CVE-2017-5565), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.