CVE-2021-28649: Trend Micro HouseCall for Home Networks Incorrect Permission Assignment Privilege Escalation Vulnerability
An incorrect permission vulnerability in the product installer for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate privileges by placing arbitrary code on a specified folder and have that code be executed by an Administrator who is running a scan. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro HouseCall for Home Networks. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions set on product folders created by the installer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of an administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-28649?
CVE-2021-28649 has a medium severity rating due to the potential for privilege escalation.
How do I fix CVE-2021-28649?
To fix CVE-2021-28649, update Trend Micro HouseCall for Home Networks to version 5.3.1180 or later.
What is the impact of CVE-2021-28649?
CVE-2021-28649 allows an attacker to escalate privileges and execute arbitrary code through improper permissions in the product installer.
Which versions are affected by CVE-2021-28649?
CVE-2021-28649 affects versions of Trend Micro HouseCall for Home Networks up to and including 5.3.1179.
Who is affected by CVE-2021-28649?
Users of Trend Micro HouseCall for Home Networks versions 5.3.1179 and below on Windows systems are affected by CVE-2021-28649.