High severity · published Feb 10, 2021
CVE-2021-25251
The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's…
7.2
CVSS
2.6%
EPSS
No
On KEV
Description
The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Antivirus+ Security 2020 · Trendmicro
16.0 · source: NVD
AS
Antivirus+ Security 2021 · Trendmicro
17.0 · source: NVD
IS
Internet Security 2020 · Trendmicro
16.0 · source: NVD
IS
Internet Security 2021 · Trendmicro
17.0 · source: NVD
MS
Maximum Security 2020 · Trendmicro
16.0 · source: NVD
MS
Maximum Security 2021 · Trendmicro
17.0 · source: NVD
PS
Premium Security 2020 · Trendmicro
16.0 · source: NVD
PS
Premium Security 2021 · Trendmicro
17.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25251
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25251
Vendor Advisory
https://helpcenter.trendmicro.com/en-us/article/TMKA-10211
More from Antivirus+ Security 2020
9.8
CVE-2019-18190
Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of application, which could potentially…
7.8
CVE-2020-27697
Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high…
7.8
CVE-2020-27696
Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to…
7.8
CVE-2020-27695
Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to…
7.8
CVE-2019-20357
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an…