CVE-2021-36745

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers 5.8, and ServerProtect for Microsoft Windows / Novell Netware 5.8 could allow a remote attacker to bypass authentication on affected installations.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro ServerProtect for Storage	6.0
Trend Micro	Trend Micro ServerProtect for EMC Celerra	5.8
Trend Micro	Trend Micro ServerProtect for Network Appliance Filers	5.8
Trend Micro	Trend Micro ServerProtect for Microsoft Windows / Novell Netware	5.8

References

https://success.trendmicro.com/jp/solution/000289030Patch, Vendor Advisory
https://success.trendmicro.com/solution/000289038Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1115/Third Party Advisory, VDB Entry
https://success.trendmicro.com/jp/solution/000289030Patch, Vendor Advisory
https://success.trendmicro.com/solution/000289038Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1115/Third Party Advisory, VDB Entry

Timeline

Published: Sep 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-367465.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.CVE-2021-367475.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.CVE-2021-367487.5A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote a CVE-2021-367496.5In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows aut CVE-2021-36757.1Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrit CVE-2021-367508.1ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVau CVE-2021-367514.2ENC DataVault 7.2.3 and before, and OEM versions, use an encryption algorithm that is vulnerable to data manipulation (without knowledge of CVE-2021-367537.8sharkdp BAT before 0.18.2 executes less.exe from the current working directory.CVE-2021-367547.5PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes a CVE-2021-367556.1Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.CVE-2021-367566.5CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.CVE-2021-367585.41Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be us