CVE-2023-3665 - A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables,

Back Back to CVE browser

HIGH

A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables,

Published Oct 4, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.23%

Description

A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code.

Affected products

Vendor Trellix Product Trellix Endpoint Security Default
unaffected
Affected
- 10.7.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Trellix	Trellix Endpoint Security	unaffected	Affected 10.7.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-94

Code Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44309
Advisory
https://kcm.trellix.com/corporate/index?page=content&id=SB10405
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44309		Advisory
https://kcm.trellix.com/corporate/index?page=content&id=SB10405		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner trellix

Published Oct 4, 2023

Updated Sep 19, 2024

Reserved Jul 13, 2023

Link CVE-2023-3665

CISA Vulnrichment

Updated Sep 19, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-3665

Red Hat

No data

ENISA EUVD

Assigner trellix

Published Oct 4, 2023

Updated Sep 19, 2024

Link EUVD-2023-44309

GitHub

No data