CVE-2020-24557: high-severity vulnerability in Trend Micro Apex One
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A flaw in Trend Micro Apex One and Worry-Free Business Security allows someone with basic access to a Windows computer to trick the product into lowering its defenses and then gain higher privileges on the system. This only works on older Windows 10 versions.
A privilege escalation vulnerability exists in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Windows, exploitable via manipulation of product folders combined with Windows hard links. Requires low-privileged code execution on the target system; Windows 10 Build 18363.719 and later mitigate the attack vector, but earlier versions remain vulnerable.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.