CVE-2020-8607: trend micro trend micro anti-threat toolkit (attk) Improper Input Validation
Vulnerability summary
CVE-2020-8607 is a high (CVSS 7.2) Improper Input Validation vulnerability in trend micro trend micro anti-threat toolkit (attk). EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.9% of scored vulnerabilities.
Timeline
- 05-08-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.55% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Trendmicro12 products
- antivirus_toolkit< 1.62.1240
- apex_one2019 | saas
- deep_security9.6 | 10.0 | 11.0 | 12.0
- officescanxg:sp1
- officescan_business_security9.0 | 9.5 | 10.0:sp1
Trend micro11 products
- trend micro anti-threat toolkit (attk)1.62.1240 and below
- trend micro apex one2019 (On premise), SaaS
- trend micro deep security12.x, 11.x. 10.x
- trend micro housecall8.0
- trend micro officescanXG SP1
2 vendors · 23 products