PatchTheCVECVE-2025-31285: A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could
CVE-2025-31285 is a medium-severity flaw (CVSS 4.6) affecting trend vision one. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 4.6 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 80%) |
| CISA exploited list | No |
| Weakness | CWE-269 |
| Published | 2025-04-02 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-31285?
trend vision one: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2025-31285 being exploited?
CVE-2025-31285 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-31285 affect?
CVE-2025-31285 affects trend vision one. Severity is medium (CVSS 4.6). A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges.
How urgent is CVE-2025-31285?
Priority 21/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-31286 MEDIUM 4.6 MITIGATE An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user
- CVE-2025-31284 MEDIUM 4.6 MITIGATE A broken access control vulnerability previously discovered in the Trend Vision One Status component could hav
- CVE-2025-31283 MEDIUM 4.6 MITIGATE A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could
- CVE-2025-31282 MEDIUM 4.6 MITIGATE A broken access control vulnerability previously discovered in the Trend Vision One User Account component cou