8.8High
KEV
CVE-2020-8467Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
Known exploited — Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-8467
Description
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Trend Micro | Trend Micro OfficeScan, Trend Micro Apex One | OfficeScan XG (12.0), Apex One 2019 (14.0) | |
| trendmicro | apex one | 2019 | |
| trendmicro | officescan | xg |
References and patches
- https://success.trendmicro.com/solution/000245571 PatchVendor Advisory
- https://success.trendmicro.com/jp/solution/000244253 PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8467 US Government Resource
CPE matches (NVD) (3)
cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*cpe:2.3:a:trendmicro:officescan:xg:-:*:*:*:*:*:*cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*