Multiple vulnerabilities in Trend Micro Apex One

1) NULL pointer dereference

EUVDB-ID: #VU57361

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-23139

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the CGI interface. A remote attacker can send a specially crafted request to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Unquoted Search Path or Element

EUVDB-ID: #VU57362

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42101

CWE-ID: CWE-428 - Unquoted Search Path or Element

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application allows inclusion of libraries from the current working directory. A local user can place a malicious binary file into a local directory on the system and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1219/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Execution with unnecessary privileges

EUVDB-ID: #VU57365

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42104

CWE-ID: CWE-250 - Execution with Unnecessary Privileges

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application performs certain unprivileged actions with elevated privileges. A local low-privileged user can abuse such behavior to execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1216/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Execution with unnecessary privileges

EUVDB-ID: #VU57369

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42108

CWE-ID: CWE-250 - Execution with Unnecessary Privileges

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application performs certain unprivileged actions with elevated privileges. A local low-privileged user can abuse such behavior to execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1217/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Unquoted Search Path or Element

EUVDB-ID: #VU57364

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42103

CWE-ID: CWE-428 - Unquoted Search Path or Element

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application allows inclusion of libraries from the current working directory. A local user can place a malicious binary file into a local directory on the system and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1213/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Execution with unnecessary privileges

EUVDB-ID: #VU57366

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42105

CWE-ID: CWE-250 - Execution with Unnecessary Privileges

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application performs certain unprivileged actions with elevated privileges. A local low-privileged user can abuse such behavior to execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1215/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Execution with unnecessary privileges

EUVDB-ID: #VU57367

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42106

CWE-ID: CWE-250 - Execution with Unnecessary Privileges

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application performs certain unprivileged actions with elevated privileges. A local low-privileged user can abuse such behavior to execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1218/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Execution with unnecessary privileges

EUVDB-ID: #VU57368

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42107

CWE-ID: CWE-250 - Execution with Unnecessary Privileges

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application performs certain unprivileged actions with elevated privileges. A local low-privileged user can abuse such behavior to execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1214/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Unquoted Search Path or Element

EUVDB-ID: #VU57363

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42102

CWE-ID: CWE-428 - Unquoted Search Path or Element

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application allows inclusion of libraries from the current working directory. A local user can place a malicious binary file into a local directory on the system and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1222/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Incorrect Privilege Assignment

EUVDB-ID: #VU57370

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42011

CWE-ID: CWE-266 - Incorrect Privilege Assignment

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect privilege assignment. A local user can load a specially crafted .dll file into the application and execute it with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1220/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Stack-based buffer overflow

EUVDB-ID: #VU57371

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42012

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error. A local user can run a specially crafted program to trigger a stack-based buffer overflow and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: CP B2049 - 2019

CPE2.3

External links

https://success.trendmicro.com/solution/000289229
https://www.zerodayinitiative.com/advisories/ZDI-21-1221/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	11
CVE-ID	CVE-2021-23139 CVE-2021-42101 CVE-2021-42104 CVE-2021-42108 CVE-2021-42103 CVE-2021-42105 CVE-2021-42106 CVE-2021-42107 CVE-2021-42102 CVE-2021-42011 CVE-2021-42012
CWE-ID	CWE-476 CWE-428 CWE-250 CWE-266 CWE-121
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Apex One Client/Desktop applications / Antivirus software/Personal firewalls
Vendor	Trend Micro