CVE-2024-36305: Trend Micro Apex One Security Agent Link Following Local Privilege Escalation Vulnerability
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One Security Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One NT RealTime Scan service. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36305?
CVE-2024-36305 has been assessed as a high-severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2024-36305?
To remediate CVE-2024-36305, update Trend Micro Apex One to the latest version available that addresses this vulnerability.
What systems are affected by CVE-2024-36305?
CVE-2024-36305 affects installations of Trend Micro Apex One prior to version 14.0.0.12980.
Can CVE-2024-36305 be exploited remotely?
No, CVE-2024-36305 requires the attacker to execute low-privileged code on the target system for exploitation.
What kind of attacks can CVE-2024-36305 lead to?
CVE-2024-36305 can lead to local privilege escalation, allowing attackers to gain elevated access rights on the affected system.