PT-2020-20229 · Trend Micro · Trend Micro Worry-Free Business Security+2

Published 2020-03-18 · Updated 2021-07-21 · CVE-2020-8598

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One version 2019 Trend Micro OfficeScan XG versions 9.0 through 10.0 Trend Micro Worry-Free Business Security versions 9.0 through 10.0

Description The server contains a vulnerable service DLL file that could allow a remote attacker to execute arbitrary code on affected installations with SYSTEM level privileges. Authentication is not required to exploit this issue.

Recommendations For Trend Micro Apex One version 2019, update to a version that includes the fix for the vulnerable service DLL file. For Trend Micro OfficeScan XG versions 9.0 through 10.0, update to a version that includes the fix for the vulnerable service DLL file. For Trend Micro Worry-Free Business Security versions 9.0 through 10.0, update to a version that includes the fix for the vulnerable service DLL file. As a temporary workaround, consider restricting access to the vulnerable service DLL file until a patch is available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-8598

Affected Products

Trend Micro Apex One

Trend Micro Officescan Xg

Trend Micro Worry-Free Business Security

References · 7

• https://success.trendmicro.com/solution/000245571 · Vendor Advisory
• https://success.trendmicro.com/jp/solution/000244253 · Vendor Advisory
• https://success.trendmicro.com/solution/000245572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8598 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8598 · Vendor Advisory
• https://success.trendmicro.com/jp/solution/000244836 · Vendor Advisory
• https://t.me/cvenotify/1838 · Telegram Post