Privilege Escalation Vulnerability in Trend Micro HouseCall for Home Networks
CVE-2021-28649

7.3HIGH

Key Information:

Vendor

Trend Micro
Status
Trend Micro Housecall For Home Networks
Vendor
CVE Published:
12 May 2021

What is CVE-2021-28649?

The vulnerability arises from incorrect permissions in the product installer for Trend Micro HouseCall for Home Networks versions 5.3.1179 and earlier. An attacker with low privileges can exploit this flaw to place arbitrary code in a specified folder. If an Administrator initiates a scan, this code could be executed, effectively allowing the attacker to escalate their privileges. It's critical for users to ensure they are operating on the latest versions and to remain vigilant against such execution risks.

Affected Version(s)

Trend Micro HouseCall for Home Networks 5.3.1179 and below

References

https://helpcenter.trendmicro.com/en-us/article/TMKA-10310
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-474/
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.