SecPod

Learn Search

Search across all Learn content

← Back to Security Research
Trend Micro Antivirus Products Exploited Wildly

Trend Micro Antivirus Products Exploited Wildly

A threat actor is actively exploiting a bug currently in Trend Micro’s security products to do privilege escalation on Windows systems. The vulnerability is tracked as CVE-2020-24557 and is affecting two major security products of the company – Apex One and OfficeScan. A good Vulnerability managemen...

Apr 22, 2021By Mohamed Faiz2 min read

A threat actor is actively exploiting a bug currently in Trend Micro’s security products to do privilege escalation on Windows systems. The vulnerability is tracked as CVE-2020-24557 and is affecting two major security products of the company – Apex One and OfficeScan. A good Vulnerability management tool can solve these issues.

Christopher Vella, a security researcher at Microsoft, privately reported the flaw to Trend Micro through the company’s bug acquisition program. Therefore, A vulnerability Management Software can prevent these attacks.

CVE-2020-24557

The issue cannot be in use of gaining access to the system, but it can be helpful to gain admin access in Windows systems if the attacker can run low-privileged code. One can exploit the flaw to temporarily disable the security by modifying certain product folders. The bug is in a piece of code that handles access to the Misc folder.

The vulnerability has been rated with a CVSS score of 7.8. POC or exploit for the bug is not available publicly.

This bug becomes the fourth vulnerability in Apex One and OfficeScan. Which isactively exploited after CVE-2019-18187, CVE-2020-8467, and CVE-2020-8468.

Impact of CVE-2020-24557

The exploitation of the vulnerability leads to privilege escalation on the affected systems.

Affected Products

  • Apex One 2019 before Build – 8422
  • Apex One (SaaS) before Build – 202008
  • OfficeScan before XG SP1 Build 5702

Solution for CVE-2020-24557

Trend Micro released fixes for the issue in its security advisory on August 2020. The fixes are available in:

Trend Micro also added that,

“Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.”

We strongly recommend installing these security updates without any delay.

Featured Posts

Open Gorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation
malware researchGorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation

CVE Research

Gorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation

Gorbag uses spearphishing and weaponized WinRAR archives to deploy BeautyStealer against Ukrainian organizations. The malware steals browser credentials, VPN configuration files, and targeted documents before exfiltrating the data and deleting itself.

Nov 5, 2026

Open Synology NAS Under Siege: C3RB3R Ransomware Strikes Unpatched Devices
vulnerability researchSynology NAS Under Siege: C3RB3R Ransomware Strikes Unpatched Devices

CVE Research

Synology NAS Under Siege: C3RB3R Ransomware Strikes Unpatched Devices

Synology has warned customers about an ongoing wave of ransomware attacks targeting network-attached storage (NAS) devices running outdated versions of DiskStation Manager (DSM). The attacks have been associated with C3RB3R ransomware, a threat capable of encrypting stored files and demanding payment for their recovery.

Nov 4, 2026

Open NetamLoader Malware Targets Asian Government Windows 10 Systems Through Advanced .NET Injection
malware researchNetamLoader Malware Targets Asian Government Windows 10 Systems Through Advanced .NET Injection

CVE Research

NetamLoader Malware Targets Asian Government Windows 10 Systems Through Advanced .NET Injection

NetamLoader is a multi-stage .NET malware loader targeting customized Windows 10 systems used by Asian government organizations. Discover its AppDomainManager injection techniques, XAML-based execution, AMSI bypass, encrypted command-and-control communications, indicators of compromise, and mitigation strategies.

Nov 2, 2026

Open Agentic AI in the Wild: How AI-Driven Attacks Are Changing Vulnerability Management
Agentic AI in the Wild: How AI-Driven Attacks Are Changing Vulnerability Management

CVE Research

Agentic AI in the Wild: How AI-Driven Attacks Are Changing Vulnerability Management

Oct 30, 2026