CVE-2021-25251
The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit this vulnerability.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.58% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- trendmicro/antivirus\+ security 2020 · trendmicro/antivirus\+ security 2021 · trendmicro/internet security 2020 · trendmicro/internet security 2021 · trendmicro/maximum security 2020 · trendmicro/maximum security 2021 · trendmicro/premium security 2020 · trendmicro/premium security 2021
- Source
- security@trendmicro.com
References
- https://helpcenter.trendmicro.com/en-us/article/TMKA-10211Vendor Advisory
- https://helpcenter.trendmicro.com/en-us/article/TMKA-10211Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.