dbcve.org
Worry Free Business Security ServicesApplication · Trendmicro

CVE-2025-49487

MEDIUM · 6.8 CVSS v3.1 Published 2025-06-17
Fix available
A fix is available. Upgrade to 6.7.3954 / 14.3.1299 or later.
See remediation →
73/100
Remediation priority · Elevated
No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in order to exploit this vulnerability due to need to access a certain hardware component. Also note: this vulnerability only affected the SaaS client version of WFBSS only, meaning the on-premise version of Worry-Free Business Security was not affected, and this issue was addressed in a previous WFBSS monthly maintenance update. Therefore no other customer action is required to mitigate if the WFBSS agents are on the regular SaaS maintenance deployment schedule and this disclosure is for informational purposes only.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

An uncontrolled search path vulnerability in Trend Micro Worry-Free Business Security Services (WFBSS) SaaS agent allows an attacker with physical access to a machine to execute arbitrary code by exploiting a specific hardware component search path.

MitigationNo customer action required if WFBSS SaaS agents are on the regular monthly maintenance deployment schedule; the vulnerability was already addressed in a previous update. Verify agent version compliance if not on automatic updates.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Worry Free Business Security ServicesApplication
Affected:>= 6.7.0.0, < 6.7.3954>= 14.0.0, < 14.3.1299

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Locate WFBSS SaaS agent installation and version
    Check Windows registry under HKLM\SOFTWARE\TrendMicro\ Worry-Free Business Security Services, or inspect Program Files\Trend Micro directory for the WFBSS agent executable. The version is typically displayed in the agent's properties or about dialog.
    Affected if If WFBSS SaaS agent is found with a version number that falls within 6.7.0.0 to 6.7.3953, or 14.0.0 to 14.3.1298, the installation is vulnerable.
  2. Verify installed version against affected ranges
    Compare the discovered version number from step 1 against the two vulnerable ranges: 6.7.0.0 through 6.7.3954 (exclusive of 6.7.3954), and 14.0.0 through 14.3.1299 (exclusive of 14.3.1299).
    Affected if If the installed version matches either of these ranges, the environment is affected by the uncontrolled search path vulnerability.
  3. Confirm SaaS agent deployment method
    Check whether the WFBSS installation was deployed via the SaaS (hosted) model rather than an on-premise server, as this CVE specifically affects the SaaS agent variant.
    Affected if If the agent is the SaaS/cloud-managed variant and the version is in the affected ranges, the vulnerability is present.

A user is affected if the WFBSS SaaS agent version is found to be 6.7.0.0 or higher but below 6.7.3954, or 14.0.0 or higher but below 14.3.1299.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 6.7.3954 / 14.3.1299 or later
Fixed in 6.7.395414.3.1299
Interim mitigation

No customer action required if WFBSS SaaS agents are on the regular monthly maintenance deployment schedule; the vulnerability was already addressed in a previous update. Verify agent version compliance if not on automatic updates.

Recommended fix High confidence

Upgrade to WFBSS SaaS version 6.7.3954 or later (6.x line); Upgrade to WFBSS SaaS version 14.3.1299 or later (14.x line)

  1. 1. Verify current Worry-Free Business Security Services (WFBSS) agent version installed on the system.
  2. 2. For SaaS clients on version 6.7.0.0 through 6.7.3953: Upgrade to version 6.7.3954 or later.
  3. 3. For SaaS clients on version 14.0.0 through 14.3.1298: Upgrade to version 14.3.1299 or later.
  4. 4. Confirm the upgrade was applied successfully and verify the new version number.
  5. 5. Note: If agents are on the regular SaaS maintenance deployment schedule, the patch is automatically applied and no manual action is required.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Worry Free Business Security Services Scoped from the published advisory
  • Consultation1.0 h
  • Testing2.0 h
  • Review / QA1.0 h
4.0 hours of engineering $750
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,200.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-49487 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-49487 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data