CVE-2020-24563: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

A vulnerability (CVE-2020-24563) was discovered in Trend Micro Apex One that could allow a local attacker to manipulate the security agent unload option process, potentially leading to privilege escalation and code execution. The vulnerability was disclosed on September 25, 2020, affecting Trend Micro Apex One 2019 and Apex One SaaS installations (ZDI Advisory, NVD).

The specific vulnerability exists within the ApexOne Security Agent, where the issue results from allowing authentication to be bypassed via a modified client that omits the authentication check. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements with low attack complexity (ZDI Advisory).

If successfully exploited, an attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. However, the attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability (ZDI Advisory).

The vulnerability requires local access to the target system and the ability to execute low-privileged code. The attacker must be able to manipulate the process of the security agent unload option when it is configured (NVD).

Trend Micro has issued an update to correct this vulnerability. Users are advised to apply the security update provided by Trend Micro (ZDI Advisory).