A vulnerability has been found in Trend Micro Apex One (the affected version is unknown) and classified as critical. Affected by this vulnerability is an unknown code. The manipulation as part of a Hard Link leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in Trend Micro Apex One on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.

The weakness was released 09/01/2020 (Website). It is possible to read the advisory at success.trendmicro.com. This vulnerability is known as CVE-2020-24557 since 08/20/2020. The exploitation appears to be easy. Attacking locally is a requirement. The exploitation doesn't need any form of authentication. Technical details are unknown but an exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/06/2025). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

It is declared as highly functional. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 11/03/2021 with a due date of 05/03/2022:

Apply updates per vendor instructions.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-160590, VDB-160592 and VDB-160593. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Endpoint Management Software

Vendor

• Trend Micro

Name

• Apex One

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion