Trend Micro Multiple Products Improper Input Validation Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03

[ Description ]Official description

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.

CISA: Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 17 Nov 2021): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• success.trendmicro.com/jp/solution/000287796Broken LinkVendor Advisory
• success.trendmicro.com/jp/solution/000287815Broken LinkVendor Advisory
• success.trendmicro.com/solution/000287819Broken LinkVendor Advisory
• success.trendmicro.com/solution/000287820Broken LinkVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource