cve/2023/CVE-2023-0975.md

### [CVE-2023-0975](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0975)
![](https://img.shields.io/static/v1?label=Product&message=Trellix%20Agent&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=5.7.8%3C%3D%205.7.8%20%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-281%20Improper%20Preservation%20of%20Permissions&color=brighgreen)

### Description

A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to replace one of the Agent’s executables before it can be executed. This allows the user to elevate their permissions.

### POC

#### Reference
- https://kcm.trellix.com/corporate/index?page=content&id=SB10396

#### Github
No PoCs found on GitHub currently.