Trend Micro · Apex One and OfficeScan
CVE-2020-8599
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
ما هي
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
CISA: Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.
ما العمل
Apply updates per vendor instructions.
الموعد النهائي للوكالات الفدرالية الأمريكية: 3 مايو 2022
ثغرات مُستغلّة أخرى من Trend Micro
| أُضيفت | الثغرة | المنتج | الخطورة | احتمال الهجوم |
|---|---|---|---|---|
| 03/11/2021 | Remote Code Execution | Apex One and OfficeScan | مرتفع 8.8 | 11% |
| 21/05/2026 | (On-Premise) Directory Traversal | Apex One | متوسطة 6.7 | 13% |
| 18/08/2025 | OS Command Injection | Apex One | حرجة 9.4 | 25% |
| 21/09/2023 | Remote Code Execution | Apex One and Worry-Free Business Security | مرتفع 7.2 | 4.2% |
| 15/09/2022 | Improper Validation | Apex One and Apex One as a Service | مرتفع 7.2 | 3.4% |
| 31/03/2022 | Arbitrary File Upload | Apex Central | حرجة 9.8 | 19% |
| 03/11/2021 | Multiple Products Content Validation Escape | Apex One, OfficeScan and Worry-Free Business Security Agents | مرتفع 8.8 | 6.2% |
| 03/11/2021 | Directory Traversal | OfficeScan | مرتفع 8.8 | 25% |
المصادر: Known Exploited Vulnerabilities (CISA، ملكية عامة)، وCVE records (cve.org)، وEPSS (FIRST). احتمال الهجوم هو تقدير EPSS لاحتمال أن يحاول أحد استغلال الثغرة خلال الأيام الـ30 القادمة.