CVE-2020-24559: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

A vulnerability (CVE-2020-24559) was discovered in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services on macOS. The vulnerability allows an attacker to manipulate a certain binary to load and run a script from a user-writable folder, enabling arbitrary code execution as root. This vulnerability requires an attacker to first obtain the ability to execute low-privileged code on the target system (ZDI Advisory, NVD).

The vulnerability was assigned a CVSS v3.1 Base Score of 7.8 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The specific flaw exists within the ApexOne Security Agent. By creating a hard link, an attacker can abuse the service to overwrite the contents of a chosen file. This vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access) (NVD, ZDI Advisory).

If successfully exploited, an attacker can leverage this vulnerability to escalate privileges and execute code in the context of root on affected macOS systems (ZDI Advisory).

The vulnerability requires an attacker to first obtain the ability to execute low-privileged code on the target system. The attack complexity is considered low, requiring low privileges and no user interaction (NVD).

Trend Micro has issued an update to correct this vulnerability. Users should apply the latest security patches provided by the vendor (ZDI Advisory).