PT-2020-16199 · Trend Micro · Trend Micro Security 2020

Abdelhamid Naceri · Published 2020-09-28 · Updated 2020-10-07 · CVE-2020-25775

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Security 2020 version 16

Description The issue allows an unprivileged user to manipulate the product's secure erase feature to delete files with a higher set of privileges due to a security race condition arbitrary file deletion vulnerability.

Recommendations For Trend Micro Security 2020 version 16, consider restricting access to the secure erase feature until a patch is available to prevent exploitation of this issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2020-25775

ZDI-20-1227

Affected Products

Trend Micro Security 2020

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-25775 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-1227 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25775 · Vendor Advisory
• https://helpcenter.trendmicro.com/en-us/article/TMKA-09909 · Vendor Advisory