{"cve":"CVE-2019-14688","nvd":{"published":"2020-02-20T23:15:20.147","modified":"2026-06-17T02:18:49.160","status":"Modified","description":"Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial product installation by an authorized user. The attacker must convince the target to download malicious DLL locally which must be present when the installer is run.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.0},"cwes":["CWE-427"],"references":["https://success.trendmicro.com/solution/1123562","https://success.trendmicro.com/solution/1123562"],"products":["trendmicro:control_manager","trendmicro:endpoint_sensor","trendmicro:im_security","trendmicro:mobile_security","trendmicro:officescan","trendmicro:scanmail","trendmicro:security","trendmicro:serverprotect"],"source":"nvd","synced_at":"2026-10-19T21:02:53.949909883+00:00"},"epss":{"cve":"CVE-2019-14688","score":0.01873,"percentile":0.79376,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}