CVE-2021-36741: Trend Micro Multiple Products Improper Input Validation Vulnerability

Vulnerability summary

CVE-2021-36741 is a high (CVSS 8.8) vulnerability in Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 4.95% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities.

Timeline

1. 29-07-2021
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVTrend Micro Multiple Products Improper Input Validation Vulnerability
3. 17-11-2021
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.

• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.