CVE-2021-25251

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-252525.5Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lCVE-2021-252537.8An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource usedCVE-2021-252545.3Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.CVE-2021-252557.5Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.CVE-2021-252617.8Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitaryCVE-2021-252625.4Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.CVE-2021-252637.8Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitaryCVE-2021-252646.7In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges.CVE-2021-252658.8A malicious website could execute code remotely in Sophos Connect Client before version 2.1.CVE-2021-252663.9An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in CVE-2021-252678.4Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0CVE-2021-252688.4Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than vers