High severity · published Sep 29, 2021
CVE-2021-32466
An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below could allow an attacker to escalate…
7.0
CVSS
0.5%
EPSS
No
On KEV
Description
An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below could allow an attacker to escalate privileges by placing a custom crafted file in a specific directory to load a malicious library. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HF
Housecall For Home Networks · Trendmicro
through 5.3.1225 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32466
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32466
Vendor Advisory
https://helpcenter.trendmicro.com/en-us/article/tmka-10626
Patch
https://helpcenter.trendmicro.com/ja-jp/article/TMKA-10621
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1112/
More from Housecall For Home Networks
7.8
CVE-2022-28339
Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user…
7.8
CVE-2021-25247
A DLL hijacking vulnerability Trend Micro HouseCall for Home Networks version 5.3.1063 and below could allow an attacker to use a malicious DLL to escalate privileges and perform…
7.8
CVE-2019-19689
Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vulnerability on the packer that the program uses
7.8
CVE-2019-19688
A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited allowing an attacker to place a malicious DLL file…
7.3
CVE-2021-31519
An incorrect permission vulnerability in the product installer folders for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate…
