CVE-2021-32466: Trend Micro HouseCall for Home Networks Uncontrolled Search Path Element Privilege Escalation Vulnerability
An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below could allow an attacker to escalate privileges by placing a custom crafted file in a specific directory to load a malicious library. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro HouseCall for Home Networks. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The process loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of an administrator.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32466?
CVE-2021-32466 is categorized as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2021-32466?
To mitigate CVE-2021-32466, users should upgrade to Trend Micro HouseCall for Home Networks version 5.3.1226 or later.
What type of attack does CVE-2021-32466 enable?
CVE-2021-32466 enables an attacker to execute a privilege escalation attack by loading a malicious library.
Which versions of Trend Micro HouseCall for Home Networks are affected by CVE-2021-32466?
CVE-2021-32466 affects all versions of Trend Micro HouseCall for Home Networks up to and including version 5.3.1225.
Can CVE-2021-32466 be exploited remotely?
CVE-2021-32466 requires local access to the system to exploit, as it involves placing a crafted file in a specific directory.