The first of the zero-days include a critical vulnerability (CVE-2020-8467) that allowed remote code execution attacks. The flaw existed in the migration tool component of Apex One and OfficeScan. Though, an attempted attack required user authentication.
The second zero-day, CVE-2020-8468, was a high severity content validation escape vulnerability that also required user authentication. Upon an exploit, the bug allowed an adversary to manipulate agent client components.
Besides, these two vulnerabilities, there were also three other bugs in Trend Micro Apex One and OfficeScan. While not exploited, all three vulnerabilities received a critical severity rating with a CVSS score of 10. All three did not require any user authentication for exploitation.
Two of these include CVE-2020-8470 and CVE-2020-8598 which existed due to vulnerable service DLL file that gave SYSTEM privileges to the attacker and arbitrary SYSTEM file deletion and code execution, respectively, on the target systems.
The third vulnerability, CVE-2020-8599, existed due to a vulnerable EXE file on Trend Micro Apex One and OfficeScan server.
Upon detecting the bugs, the vendors fixed them and released the patches with Apex One* (on-premise) version CP 2117 and OfficeScan version XG SP1 CP 5474 and XG CP 1988.
In their advisory, Trend Micro also confirmed detection of active exploitation of the two zero-day vulnerabilities.
Trend Micro has observed active attempts of potential attacks against at least one of these vulnerabilities in the wild (ITW).They urge all the users to update their systems to the patched versions ASAP.
Let us know your thoughts in the comments.
