CVE-2021-45440

moderate-risk
Published 2022-01-10

A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on-prem versions only) could allow a local attacker to abuse an impersonation privilege and elevate to a higher level of privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Do I need to act?

-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (4)

Affected Vendors

Trendmicro

References (4)

Patch https://success.trendmicro.com/solution/000289996
Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-22-016/
Patch https://success.trendmicro.com/solution/000289996
Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-22-016/
34
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 0/34 · Minimal
Exposure 10/34 · Low