CVE-2019-14688
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize...
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run.
- Record
CVE-2019-14688- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-427
- Updated
- 2026-11-02
CVE List No score
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run.
- Record
CVE-2019-14688- Updated
- 2026-11-02
EUVDEUVD-2019-5839 No score
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run.
- Record
EUVD-2019-5839- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g7xx-c9x7-78fj No score
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize...
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run.
- Record
GHSA-g7xx-c9x7-78fj- Updated
- 2026-11-02
Affected products
- trend micro im security (ims), trend micro control manager (tmcm), trend micro officescan (osce), trend micro endpoint sensor (tmes), trend micro security (consumer), trend micro scanmail for microsoft exchange (smex), trend micro serverprotect (sp), trend micro mobile security enterprise (tmms enterprise)
- trendmicro control manager
- trendmicro endpoint sensor
- trendmicro im security
- trendmicro mobile security
- trendmicro officescan
- trendmicro scanmail
- trendmicro security
- trendmicro serverprotect
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-14688 is a high vulnerability (CVSS 7.0) in Trend Micro Im Security (ims), Trend Micro Control Manager (tmcm), Trend Micro Officescan (osce), Trend Micro Endpoint Sensor (tmes), Trend Micro Security (consumer), Trend Micro Scanmail For Microsoft Exchange (smex), Trend Micro Serverprotect (sp), Trend Micro Mobile Security Enterprise (tmms Enterprise), published February 20, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.87%, the 79th percentile. No source names a fixed version.