CVE-2021-36742: Trend Micro Multiple Products Improper Input Validation Vulnerability

Vulnerability summary

CVE-2021-36742 is a high (CVSS 7.8) Improper Input Validation vulnerability in Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.5% of scored vulnerabilities.

Timeline

1. 29-07-2021
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVTrend Micro Multiple Products Improper Input Validation Vulnerability
3. 17-11-2021
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.