cyfenced.com →

[ CVE-2021-36742 · Published 29 Jul 2021 ]

Trend Micro Multiple Products Improper Input Validation Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 1%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03

[ Description ]Official description

A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CISA: Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 17 Nov 2021): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References