Local Security Bypass Vulnerability in Trend Micro Network Security Component

CVE-2008-3866

What is CVE-2008-3866?

The Trend Micro Network Security Component (NSC) contains a vulnerability in its Personal Firewall service, TmPfw.exe. This flaw arises due to reliance on client-side password protection within the configuration GUI, which can be exploited by local users. By utilizing a modified client to send specifically crafted packets, these users can unintentionally bypass access controls. Consequently, this allows unauthorized changes to firewall settings, posing significant security risks to users reliant on Trend Micro's products for their digital safety.

References