CVE-2021-25253: Trend Micro Apex One Improper Access Control Privilege Escalation Vulnerability
An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the ApexOne Security Agent. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25253?
CVE-2021-25253 has a medium severity level due to potential privilege escalation risks for local attackers.
How do I fix CVE-2021-25253?
To fix CVE-2021-25253, update to the latest available version of Trend Micro Apex One or OfficeScan that addresses this vulnerability.
Who is affected by CVE-2021-25253?
CVE-2021-25253 affects installations of Trend Micro Apex One, Apex One as a Service, and OfficeScan XG SP1.
What type of attack does CVE-2021-25253 facilitate?
CVE-2021-25253 facilitates privilege escalation attacks by local users on the affected systems.
What versions of Trend Micro products are vulnerable to CVE-2021-25253?
CVE-2021-25253 affects Trend Micro Apex One 2019 and Trend Micro OfficeScan XG SP1.