CVE-2020-8607
6.7MEDIUM
Key Information:
- Vendor
- Trend Micro
- Status
- Vendor
- CVE Published:
- 5 August 2020
Summary
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
Affected Version(s)
Trend Micro Anti-Threat Toolkit (ATTK) 1.62.1240 and below
Trend Micro Apex One 2019 (On premise), SaaS
Trend Micro Deep Security 12.x, 11.x. 10.x
References
CVSS V3.1
Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved