PT-2020-6073 · Trend Micro · Trend Micro Officescan Xg

Khangkito + 1 · Published 2020-09-25 · Updated 2021-07-21 · CVE-2020-24562

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro OfficeScan XG SP1

Description A vulnerability in Trend Micro OfficeScan may allow an attacker to create a hard link to any file on the system, which could then be manipulated to gain privilege escalation and code execution. The attacker must first obtain the ability to execute low-privileged code on the target system to exploit this issue. It is related to errors in privilege management.

Recommendations For Trend Micro OfficeScan XG SP1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Improper Privilege Management

Weakness Enumeration

CWE-59

CWE-269

Related Identifiers

BDU:2021-02923

CVE-2020-24562

ZDI-20-1226

Affected Products

Trend Micro Officescan Xg

References · 5

• https://zerodayinitiative.com/advisories/ZDI-20-1226 · Security Note
• https://success.trendmicro.com/solution/000263633 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24562 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24562 · Security Note