Cyber Resilience

CVE-2025-49216

Trendmicro Trend Micro Endpoint Encryption ≤ 6.0.0.4013

Published
17 June 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0051 41th percentile
Risk Priority 71 floored blend · peak EPSS

Summary

CVE-2025-49216 is a critical-severity Use of Obsolete Function (CWE-477) vulnerability in Trendmicro Trend Micro Endpoint Encryption. Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A03:2025 Software Supply Chain Failures

EU & UK References

Vulnerability Data

An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.

CWE(s)
CWE-477

Related Threats

CVEs Like This One

CVE-2025-49212Same product: Microsoft Windows
CVE-2025-49214Same product: Microsoft Windows
CVE-2025-49213Same product: Microsoft Windows
CVE-2025-49217Same product: Microsoft Windows
CVE-2025-49215Same product: Microsoft Windows
CVE-2025-49211Same product: Microsoft Windows
CVE-2025-49218Same product: Microsoft Windows
CVE-2023-28005Same product: Microsoft Windows
CVE-2025-49220Same product: Microsoft Windows
CVE-2025-49219Same product: Microsoft Windows

Affected Assets

trendmicro
trend micro endpoint encryption
≤ 6.0.0.4013

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation partial match

Developer testing and evaluation can surface use of deprecated functions through static analysis or code review.

SA-15 Development Process, Standards, and Tools partial match

Documented developer standards and tools can mandate current APIs and prohibit deprecated functions during coding.

SI-2 Flaw Remediation partial match

Flaw remediation processes and updates can identify and replace obsolete functions discovered after introduction.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-02 mostly match
prevents

Software maintenance and replacement directly eliminates use of deprecated functions.

PR.PS-06 mostly match
prevents

Secure SDLC practices enforce review and removal of obsolete functions during development.

ID.AM-08 partial match
prevents

Lifecycle management of software includes replacing obsolete functions and code.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC processes include code reviews and maintenance that catch obsolete functions.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly prohibit use of deprecated/obsolete functions.

A.8.32 Change management partial match
prevents

Change management can trigger reviews that remove obsolete functions but does not directly address them.

A.8.8 Management of technical vulnerabilities none match
none

Vulnerability management may flag deprecated functions as known weaknesses during scans.

References