CVE-2022-28394

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-27 · updated 2026-06-17
Weakness: CWE-427

Description

EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427). Please note that this was reported on an EOL version of the product, and users are advised to upgrade to the latest supported version (5.x).

Affected products

Trend Micro Password Manager: before 3.7.0.1223 — fixed in 3.7.0.1223

How to fix

Upgrade to a fixed version: Trend Micro Password Manager 3.7.0.1223. Check the vendor advisory for mitigations.

References

https://helpcenter.trendmicro.com/ja-jp/article/TMKA-10977
https://jvn.jp/en/jp/JVN60037444/
https://jvn.jp/jp/JVN60037444/
https://helpcenter.trendmicro.com/ja-jp/article/TMKA-10977
https://jvn.jp/en/jp/JVN60037444/
https://jvn.jp/jp/JVN60037444/

Get alerted when CVE-2022-28394 or the next vulnerability affects your stack