CVE-2021-32462

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Exposed Hazardous Function Remote Code Execution vulnerability which could allow an unprivileged client to manipulate the registry and escalate privileges to SYSTEM on affected installations. Authentication is required to exploit this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Password Manager	5.0.0.1217 and below

References

https://helpcenter.trendmicro.com/en-us/article/TMKA-10388Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-774/Third Party Advisory, VDB Entry
https://helpcenter.trendmicro.com/en-us/article/TMKA-10388Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-774/Third Party Advisory, VDB Entry

Timeline

Published: Jul 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-324637.8An incorrect permission assignment denial-of-service vulnerability in Trend Micro Apex One, Apex One as a Service (SaaS), Worry-Free Busines CVE-2021-324647.8An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business CVE-2021-324658.8An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a remote CVE-2021-324667.0An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below CVE-2021-324677.5MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected Setup) protocol. (A CVE-2021-324687.5MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected Setup) protocol. (A CVE-2021-324697.5MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected Setup) protocol. (A CVE-2021-324706.1Craft CMS before 3.6.13 has an XSS vulnerability.CVE-2021-324717.8Insufficient input validation in the Marvin Minsky 1967 implementation of the Universal Turing Machine allows program users to execute arbit CVE-2021-324724.3Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.CVE-2021-324735.3It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to CVE-2021-324747.2An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this re