A cohort of major cybersecurity vendors has released patches for severe vulnerabilities across several widely deployed security products. According to SecurityWeek, Trend Micro, Tanium, ESET, and Tenable have all disclosed flaws that could allow attackers to perform RCE or achieve Privilege Escalation. These findings are particularly sensitive because the affected software is often used by organizations to defend their perimeters and internal systems, meaning a compromise of the security tool itself can lead to a complete loss of environment integrity.
Trend Micro Deep Security RCE Mitigation and CVE-2024-48904
The most critical CVE addressed in this cycle is CVE-2024-48904, which carries a CVSS score of 9.8. This flaw affects Trend Micro Deep Security and Cloud One — Endpoint and Workload Security agents. The vulnerability is a command injection issue residing in the agent’s Linux installation script. An attacker with the ability to provide input to the installation process could execute arbitrary commands with root privileges.
Organizations utilizing automated deployment scripts for their cloud workloads are at the highest risk. Security teams looking for how to detect CVE-2024-48904 exploit traffic should monitor for unusual subprocess spawns from agent installation scripts or unexpected outbound connections during the provisioning phase. Trend Micro has released updated agents for various Linux distributions to address this flaw.
Tanium Client Privilege Escalation Fix (CVE-2024-37302)
Tanium has patched CVE-2024-37302, a vulnerability in the Tanium Client for Windows that could lead to a local Privilege Escalation. With a CVSS score of 8.8, this flaw allows a low-privileged user to execute code with SYSTEM-level privileges. This type of vulnerability is a common target for threat actors who have already gained an initial foothold and are attempting Lateral Movement.
The Tanium Client is a high-value target for attackers because it is an EDR component that typically runs with the highest possible permissions. A successful exploit bypasses standard security controls by leveraging the trusted status of the security agent itself. The Tanium Client privilege escalation fix requires upgrading the client software to version 7.4.10 or later on Windows systems.
ESET and Tenable Vulnerability Analysis
ESET disclosed CVE-2024-7400, a vulnerability affecting several Windows-based security products, including ESET NOD32 Antivirus and ESET Endpoint Security. The flaw involves a file deletion vulnerability that can be manipulated via symlinks. If exploited, a local attacker could delete arbitrary files, potentially disabling security protections or escalating privileges. ESET has released updates for all affected product lines, and users are encouraged to ensure their virus signature databases and program components are current.
Similarly, Tenable addressed CVE-2024-1210 in its Nessus Network Monitor (NNM). This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on the system running NNM. Since NNM is designed to provide visibility into network traffic, it often sits in sensitive network segments. Tenable has released NNM version 6.4.0 to mitigate this risk.
Strategic Mitigation Recommendations
Defending against vulnerabilities in security software requires a proactive patch management strategy. Because security agents often operate at the kernel level or with administrative rights, they are prime candidates for exploitation by APT groups seeking to evade detection. Defenders should prioritize the following actions:
- Automate Agent Updates: Ensure that EDR and antivirus agents are configured to pull updates automatically from a central management console.
- Audit Installation Scripts: Specifically for the Trend Micro vulnerability, review any custom orchestration or CI/CD pipelines that handle agent deployment on Linux systems.
- Monitor Agent Health: Use your SIEM to alert on security agents that stop reporting or show signs of tampering, which may indicate an attempt to exploit local vulnerabilities.