← Vulnerability feed

Vulnerability record · CVE-2019-20357 · published 18 January 2020

CVE-2019-20357: Trendmicro antivirus \+ security 2019 unquoted search path vulnerability

Trendmicro · Antivirus \+ Security 2019

A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.

7.8 CVSS 3.1 High EPSS 0.73% · top 47.4% CWE-428 · Unquoted search path
7.8CVSS 3.1 base score, v2 7.2
0.73%EPSS exploitation probability, 30 days
NoNot in CISA KEV
8Affected product versions listed by NVD
6References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-SECURITY-CONSUMER-PERSISTENT-ARBITRARY-CODE-EXECUTION.txt ExploitThird Party Advisory
https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124099.aspx Vendor Advisory
https://seclists.org/bugtraq/2020/Jan/28 ExploitIssue TrackingMailing ListThird Party Advisory
http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-SECURITY-CONSUMER-PERSISTENT-ARBITRARY-CODE-EXECUTION.txt ExploitThird Party Advisory
https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124099.aspx Vendor Advisory
https://seclists.org/bugtraq/2020/Jan/28 ExploitIssue TrackingMailing ListThird Party Advisory

Track CVE-2019-20357 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-18190Trendmicro antivirus\+ security 2020 null pointer dereference vulnerabilityTrend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of applicati…EPSS 2.7%7.8CVE-2021-36744Trendmicro maximum security 2019 link following vulnerabilityTrend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit the syste…EPSS 0.47%7.8CVE-2020-27695Trendmicro antivirus\+ security 2020 untrusted search path vulnerabilityTrend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local …EPSS 0.47%7.8CVE-2020-27696Trendmicro antivirus\+ security 2020 vulnerabilityTrend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows system d…EPSS 0.47%7.8CVE-2020-27697Trendmicro antivirus\+ security 2020 link following vulnerabilityTrend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-pr…EPSS 0.57%7.8CVE-2020-15602Trendmicro antivirus\+ 2020 untrusted search path vulnerabilityAn untrusted search path remote code execution (RCE) vulnerability in the Trend Micro Secuity 2020 (v16.0.0.1146 and below) consumer family of produc…EPSS 1.0%7.8CVE-2019-15628Trendmicro antivirus \+ security 2020 untrusted search path vulnerabilityTrend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specif…EPSS 0.52%7.8CVE-2019-14685Trendmicro antivirus \+ security 2019 unquoted search path vulnerabilityA local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate …EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2019-20357), CISA KEV, FIRST EPSS (scores of 2026-10-01). This page is refreshed as NVD updates the record.