{"id":"CVE-2025-49217","published":"2025-06-17T20:28:14Z","modified":"2025-06-18T15:53:47Z","title":"An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a…","vendor":"Trend Micro","product":"Trend Micro Endpoint Encryption Policy Server","tier":"tail","description":{"text":"An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01093,"percentile":0.6532,"provenance":"source"},"cwes":[{"id":"CWE-477","name":"Use of Obsolete Function"}],"references":[{"url":"https://success.trendmicro.com/en-US/solution/KA-0019928","tags":[]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-374/","tags":[]}],"priority":{"score":19.9,"factors":[{"name":"EPSS percentile","points":13.06},{"name":"CVSS severity","points":6.86}]},"vendorSlug":"trend-micro","affectedVersions":[{"vendor":"Trend Micro, Inc.","product":"Trend Micro Endpoint Encryption Policy Server","versions":[">= 6.0, < 6.0.0.4013"]}],"euvd":{"id":"EUVD-2025-18650","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-trend-micro-endpoint-encryption-policy-s-cve-2025-49212","parents":[{"from":"CVE-2025-49213","to":"CVE-2025-49217","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"Note that this vulnerability is similar to CVE-2025-49213 but is in a different method.","from":"CVE.org","in":"CVE-2025-49217"},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}]}}