CVE-2021-28645

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Apex One	2019, SaaS
Trend Micro	Trend Micro OfficeScan	XG SP1

References

https://success.trendmicro.com/solution/000286019Vendor Advisory
https://success.trendmicro.com/solution/000286157Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-402/Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/000286019Vendor Advisory
https://success.trendmicro.com/solution/000286157Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-402/Third Party Advisory, VDB Entry

Timeline

Published: Apr 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-286465.5An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker CVE-2021-286477.8Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a m CVE-2021-286487.8Trend Micro Antivirus for Mac 2020 v10.5 and 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerabil CVE-2021-286497.3An incorrect permission vulnerability in the product installer for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could CVE-2021-286505.5autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal duri CVE-2021-286517.5An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resol CVE-2021-286524.9An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack CVE-2021-286536.5The iOS and macOS apps before 1.4.1 for the Western Digital G-Technology ArmorLock NVMe SSD store keys insecurely. They choose a non-preferr CVE-2021-286556.5The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary CVE-2021-286565.4Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This CVE-2021-286575.5A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should CVE-2021-286585.3In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with su