CVSS 4.0
7.2 highCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:HCVE-2025-3771
High (7.2) in trellix system information reporter. EPSS 0.2% chance of exploitation in the next 30 days.
A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, which can potentially cause a system crash. This was achieved by adding a malicious entry to the registry under the Trellix SIR registry folder or via policy or with a junction symbolic link to files that the user would not normally have permission to acces
Severity
CVSS 3.1
7.1 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-31)
- CWE
- CWE-59
- Published
- Modified
- Record from
- the NVD, synced
Affected
- trellix:system_information_reporter