CVE-2020-8599 - Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login

Back Back to CVE browser

CRITICAL KEV

Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login

Published Mar 18, 2020 ·Due May 3, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 11.86%

Description

Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.

Affected products

Vendor Trend Micro Product Trend Micro OfficeScan, Trend Micro Apex One Default
n/a
- Version
  OfficeScan XG (12.0), Apex One 2019 (14.0)
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Trend Micro

Trend Micro OfficeScan, Trend Micro Apex One

n/a

Version	Status	Constraints
OfficeScan XG (12.0), Apex One 2019 (14.0)	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://success.trendmicro.com/jp/solution/000244253
x_refsource_MISCBroken LinkPatchVendor Advisory
https://success.trendmicro.com/solution/000245571
x_refsource_MISCBroken LinkPatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8599
government-resourceUS Government Resource

Link	Providers	Tags
https://success.trendmicro.com/jp/solution/000244253		x_refsource_MISCBroken LinkPatchVendor Advisory
https://success.trendmicro.com/solution/000245571		x_refsource_MISCBroken LinkPatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8599		government-resourceUS Government Resource