CVE-2020-24562: 
Trend Micro OfficeScan vulnerability analysis and mitigation

A vulnerability (CVE-2020-24562) was discovered in Trend Micro OfficeScan XG SP1 on Microsoft Windows. The vulnerability allows an attacker to create a hard link to any file on the system, which could be manipulated to gain privilege escalation and code execution. The vulnerability was disclosed on September 25, 2020, and requires an attacker to first obtain the ability to execute low-privileged code on the target system (ZDI Advisory).

The specific flaw exists within the OfficeScan Security Agent. The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with the vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. By creating a hard link, an attacker can abuse the service to overwrite the contents of a chosen file (ZDI Advisory, NVD).

If successfully exploited, an attacker can leverage this vulnerability to escalate privileges and execute code as an administrator. This could potentially lead to complete system compromise (ZDI Advisory).

The vulnerability requires an attacker to first obtain the ability to execute low-privileged code on the target system. The attack can then be performed locally to escalate privileges (ZDI Advisory).

Trend Micro has issued an update to correct this vulnerability. Users should apply the latest security patches provided by Trend Micro (ZDI Advisory).