PT-2021-16466 · Trend Micro · Trend Micro Worry-Free Business Security 10.0 Sp1+2

Elias Martinez · Published 2021-01-29 · Updated 2021-02-08 · CVE-2021-25228

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex One versions (affected versions not specified) Trend Micro OfficeScan XG SP1 Trend Micro Worry-Free Business Security 10.0 SP1

Description: The issue is related to improper access control, which could allow an unauthenticated user to obtain information about hotfix history. There is no information available about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations: For Trend Micro Apex One, update to a version that addresses the improper access control issue. For Trend Micro OfficeScan XG SP1, consider restricting access to sensitive information until a patch is available. For Trend Micro Worry-Free Business Security 10.0 SP1, avoid using the software until a fixed version is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-25228

ZDI-21-103

Affected Products

Trend Micro Apex One

Trend Micro Officescan Xg Sp1

Trend Micro Worry-Free Business Security 10.0 Sp1

References · 6

• https://success.trendmicro.com/solution/000284206 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25228 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25228 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-103 · Security Note
• https://success.trendmicro.com/solution/000284205 · Vendor Advisory
• https://success.trendmicro.com/solution/000284202 · Vendor Advisory