CVE-2020-15604: trend micro trend micro security (consumer) Improper Certificate Validation
Vulnerability summary
CVE-2020-15604 is a high (CVSS 7.5) Improper Certificate Validation vulnerability in trend micro trend micro security (consumer). EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.2% of scored vulnerabilities.
Timeline
- 24-09-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-494: Update files are not properly verified.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.36%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
-0.26 pp
From 1.62% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
- CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
Affected systems
Trendmicro5 products
- antivirus\+_2019≤ 15.0
- internet_security_2019≤ 15.0
- maximum_security_2019≤ 15.0
- officescan_cloud15
- premium_security_2019≤ 15.0
Trend micro1 product
- trend micro security (consumer)2019 (v15)
2 vendors · 6 products