CVE-2025-30640: Deep Security Agent Privilege Escalation

CVE-2025-30640 Overview

CVE-2025-30640 is a link following vulnerability in Trend Micro Deep Security 20.0 agents running on Microsoft Windows. A local attacker with the ability to execute low-privileged code on an affected system can abuse this flaw to escalate privileges. The issue is tracked under CWE-59: Improper Link Resolution Before File Access ('Link Following') and was disclosed through the Zero Day Initiative as ZDI-25-239. Trend Micro published remediation guidance in Solution Article KA-0019344.

Critical Impact
A local, authenticated attacker can escalate privileges to a higher-privileged context on Windows hosts running vulnerable Deep Security Agent 20.0 builds, compromising confidentiality, integrity, and availability.

Affected Products

Trend Micro Deep Security Agent 20.0 (Long Term Support) — base release and multiple updates including update690, update3180, update4540, update7380, update9400, update12510, update14610, update17380, update19250, update21510, and update23340
Trend Micro Deep Security Agent 20.0.1 (Long Term Support)
Microsoft Windows installations hosting the affected agent

Discovery Timeline

2025-06-17 - CVE-2025-30640 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-30640

Vulnerability Analysis

The vulnerability is a link following weakness in the Trend Micro Deep Security Agent for Windows. Deep Security Agent runs with elevated privileges to perform host-based intrusion prevention, integrity monitoring, and anti-malware operations. When the agent performs file operations on paths that a low-privileged user can influence, it fails to safely resolve symbolic links, junctions, or hard links before acting on the target. An attacker can plant a link that redirects the agent's privileged file operation to an arbitrary location, resulting in privileged file write, overwrite, or deletion primitives that lead to local privilege escalation.

Root Cause

The root cause is improper link resolution before file access, classified under CWE-59. The affected agent code performs file system operations without first verifying that path components are not attacker-controlled reparse points. On Windows, this pattern is commonly abused via NTFS junctions and object-manager symbolic links created by unprivileged users in writable directories.

Attack Vector

Exploitation requires local access and the ability to execute low-privileged code on the target host. The attacker prepares a directory or file location that the Deep Security Agent later interacts with, then substitutes that path with a link pointing to a protected file. When the agent operates on the crafted path in its elevated context, the operation is redirected, yielding privileged file manipulation and ultimately code execution or persistence in a higher privilege context.

No verified public proof-of-concept code is available. Full technical detail is maintained in the Zero Day Initiative advisory ZDI-25-239.

Detection Methods for CVE-2025-30640

Indicators of Compromise

Creation of NTFS junctions, mount points, or symbolic links inside directories used by ds_agent.exe or other Deep Security Agent components by non-administrative users.
Unexpected modifications, replacements, or deletions of files in system-protected locations shortly after Deep Security Agent file operations.
New privileged processes or services spawning from paths previously writable by standard users.

Detection Strategies

Monitor for use of CreateSymbolicLink, mklink /J, and DeviceIoControl with FSCTL_SET_REPARSE_POINT originating from non-administrative sessions in directories touched by the agent.
Audit Windows Security Event ID 4663 (object access) on Deep Security Agent working directories and correlate with the effective SID performing the operation.
Baseline the version of installed Deep Security Agents across the fleet and flag hosts still running vulnerable 20.0 or 20.0.1 builds listed in KA-0019344.

Monitoring Recommendations

Enable Windows Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime changed) on Deep Security Agent installation and temporary directories.
Alert on any low-privileged process writing reparse points into directories owned by SYSTEM or Administrators.
Track process ancestry when child processes of the Deep Security Agent write, rename, or delete files outside its expected working set.

How to Mitigate CVE-2025-30640

Immediate Actions Required

Inventory all Windows hosts running Trend Micro Deep Security Agent 20.0 and 20.0.1 and identify builds listed as vulnerable in the vendor advisory.
Apply the fixed Deep Security Agent build referenced in Trend Micro KA-0019344 as soon as change control allows.
Restrict interactive and remote low-privileged access on servers hosting the agent until patching completes, since exploitation requires local code execution.
Review local account privileges and remove unnecessary logon rights on sensitive Windows servers.

Patch Information

Trend Micro has released fixed builds of Deep Security Agent 20.0. Refer to Trend Micro Solution KA-0019344 for the exact fixed version numbers and deployment guidance. Administrators should update through Deep Security Manager or the standard agent upgrade workflow.

Workarounds

Limit local logon on affected servers to trusted administrative accounts to remove the low-privileged foothold required for exploitation.
Harden ACLs on directories used by the Deep Security Agent so that non-administrative users cannot create files or reparse points in those paths.
Enable the Windows setting that restricts symbolic link creation to administrators via Group Policy Create symbolic links (SeCreateSymbolicLinkPrivilege).

bash

# Verify Deep Security Agent version on a Windows host
"C:\Program Files\Trend Micro\Deep Security Agent\dsa_control.cmd" -v

# Restrict symbolic link creation privilege to Administrators (secpol.msc)
# User Rights Assignment -> "Create symbolic links" -> Administrators only

# Audit reparse point creation using Sysmon (config excerpt)
# <RuleGroup name="" groupRelation="or">
#   <FileCreate onmatch="include">
#     <TargetFilename condition="contains">\Trend Micro\Deep Security Agent\</TargetFilename>
#   </FileCreate>
# </RuleGroup>