High severity · published Mar 18, 2020
CVE-2020-8470
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an attacker to delete…
7.5
CVSS
4.6%
EPSS
No
On KEV
Description
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an attacker to delete any file on the server with SYSTEM level privileges. Authentication is not required to exploit this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.6% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Apex One · Trend Micro
2019 · source: NVD
OF
Officescan · Trendmicro
xg; xg · source: NVD
WB
Worry-free Business Security · Trendmicro
9.0; 9.5; 10.0; 10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8470
Patch
https://success.trendmicro.com/jp/solution/000244253
Patch
https://success.trendmicro.com/jp/solution/000244836
Patch
https://success.trendmicro.com/solution/000245571
Patch
https://success.trendmicro.com/solution/000245572
More from Apex One
9.8
CVE-2025-54948
Trend Micro Apex One OS Command Injection Vulnerability
9.8
CVE-2022-26871
Trend Micro Apex Central Arbitrary File Upload Vulnerability
9.8
CVE-2020-8599
Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
8.8
CVE-2021-36741
Trend Micro Multiple Products Improper Input Validation Vulnerability
8.8
CVE-2020-8468
Trend Micro Multiple Products Content Validation Escape Vulnerability