CVE-2025-30641: Trend Micro Deep Security Privilege Escalation

CVE-2025-30641 Overview

CVE-2025-30641 is a link following vulnerability [CWE-59] in the anti-malware component of Trend Micro Deep Security Agent 20.0 on Windows. A local attacker with the ability to execute low-privileged code on the target host can abuse the flaw to escalate privileges. The agent follows attacker-controlled links (such as symbolic links, junctions, or hard links) when performing privileged file operations, allowing the attacker to redirect those operations to sensitive locations. Successful exploitation yields code execution in the context of the SYSTEM-level agent.

Critical Impact
A low-privileged local user can gain full SYSTEM-equivalent privileges on affected Windows endpoints running Trend Micro Deep Security Agent 20.0.

Affected Products

Trend Micro Deep Security Agent 20.0 (Long Term Support) on Microsoft Windows
Deep Security Agent 20.0.1 and multiple update branches (update690 through update23340)
Microsoft Windows endpoints running the affected agent

Discovery Timeline

2025-06-17 - CVE-2025-30641 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-30641

Vulnerability Analysis

The flaw resides in the anti-malware solution portion of the Deep Security Agent. The agent performs file operations without adequately validating whether target paths point to legitimate objects or attacker-controlled links. Because the agent runs with elevated privileges on Windows, any file operation it performs against a redirected path executes with those privileges. Exploitation requires local access and the ability to run low-privileged code, but does not require user interaction. The result is a full compromise of confidentiality, integrity, and availability on the affected host.

Root Cause

The root cause is improper resolution of file system links before privileged file operations, categorized as [CWE-59] Improper Link Resolution Before File Access. The anti-malware component does not verify link targets, allowing symbolic links, mount points, or hard links planted by an unprivileged user to be followed as if they were direct file accesses.

Attack Vector

An attacker executing code as a standard Windows user creates a file or directory in a location the Deep Security Agent later touches (for example, a quarantine, log, or working directory). The attacker replaces or seeds that path with a Windows junction, hard link, or symbolic link pointing to a protected file such as a binary in C:\Windows\System32 or a service configuration file. When the agent performs its privileged write, delete, or attribute operation, the operation is redirected to the linked target, letting the attacker overwrite or manipulate SYSTEM-owned files and pivot to code execution as SYSTEM. See the Zero Day Initiative Advisory ZDI-25-240 for additional technical context.

Detection Methods for CVE-2025-30641

Indicators of Compromise

Creation of NTFS junctions, hard links, or symbolic links inside directories used by the Deep Security Agent (quarantine, temp, log, and update paths) by non-administrative users.
Unexpected modification, replacement, or deletion of files in C:\Windows\System32 or other SYSTEM-owned locations correlated in time with Deep Security Agent activity.
New or modified services, scheduled tasks, or auto-start entries created shortly after Deep Security Agent file operations on a low-privileged user session.

Detection Strategies

Hunt for mklink /J, mklink /H, or programmatic CreateSymbolicLink/DeviceIoControl (FSCTL_SET_REPARSE_POINT) usage originating from non-admin processes.
Monitor process lineage where a SYSTEM-level Deep Security Agent process writes to paths that resolve outside its expected working directories.
Correlate file integrity monitoring alerts on protected system paths with concurrent Deep Security Agent I/O.

Monitoring Recommendations

Enable Windows object access auditing on Deep Security Agent working directories and on sensitive SYSTEM paths.
Ingest endpoint telemetry into a centralized data lake and alert on reparse point creation by unprivileged users.
Track process integrity level transitions where a Medium-integrity user action precedes a High/System-integrity file write to a protected location.

How to Mitigate CVE-2025-30641

Immediate Actions Required

Inventory all Windows endpoints running Trend Micro Deep Security Agent 20.0 and identify their current update level.
Apply the fixed Deep Security Agent build referenced in the Trend Micro Solution KA-0019344 as a priority.
Restrict interactive and remote low-privileged access on hosts that cannot be patched immediately.

Patch Information

Trend Micro has published remediation guidance for CVE-2025-30641 in security bulletin KA-0019344. Administrators should upgrade Deep Security Agent 20.0 installations to the fixed maintenance release identified in that advisory. Additional technical details are available in Zero Day Initiative Advisory ZDI-25-240.

Workarounds

Limit local logon and code execution rights on servers running Deep Security Agent so that only trusted administrators can seed attacker-controlled links.
Harden ACLs on Deep Security Agent working, quarantine, and log directories to prevent standard users from creating reparse points.
Where supported, enable Windows policy restrictions on symbolic link creation for non-administrators via fsutil behavior set SymlinkEvaluation.

bash

# Restrict symbolic link evaluation to local-to-local only for non-admins
fsutil behavior set SymlinkEvaluation L2L:1 L2R:0 R2L:0 R2R:0