Horizon Alert
Summary of the vulnerability and why it matters
Trend Micro security products on Microsoft Windows contain a flaw that could allow an attacker to elevate their privileges on a system. This issue requires the attacker to already have some level of access to execute code on the affected machine. Once achieved, the attacker could manipulate specific product folders to disable security features temporarily. This manipulation can lead to abusing Windows functions and gaining higher system privileges.
- Vulnerable Trend Micro products
- Folder manipulation disables security
- Privilege escalation on Windows systems
Attack Path
How an attacker could exploit the issue
A vulnerability in Trend Micro products may allow an attacker with existing low-privileged code execution to escalate their privileges. This is achieved by manipulating a product folder to temporarily disable security and then abusing a specific Windows function. Organizations using affected versions of Trend Micro Apex One or Worry-Free Business Security on Microsoft Windows are potentially at risk.
- Low-privileged code execution required.
- Manipulate product folder.
- Disable security and escalate privileges.
Live Threat
Current exploitation, exposure, and threat context
The vulnerability in Trend Micro products running on Windows allows a local attacker with low-privileged code execution to elevate their privileges. This can be achieved by manipulating product folders to disable security features and abuse specific Windows functions. While Windows 10 version 1909 mitigates some aspects, earlier versions remain affected.
- Attacker skill level: Low
- Required access: Low-privileged code execution
- Business risk or urgency: High
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability may allow a local attacker with low-privileged code execution to escalate their privileges on affected systems. Attackers could manipulate product folders to temporarily disable security features and abuse Windows functions. Organizations should take immediate action to identify and mitigate this risk.
- Find affected Trend Micro products.
- Reduce exposure or isolate risk.
- Apply vendor fix, verify, and monitor.
