CVE-2020-25770: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

A local information disclosure vulnerability (CVE-2020-25770) was discovered in Trend Micro Apex One's scanServer64 module. The vulnerability was reported on May 12, 2020, and publicly disclosed on September 25, 2020. This security flaw affects installations of Trend Micro Apex One (ZDI Advisory).

The vulnerability exists within the scanServer64 module of Trend Micro Apex One. The specific issue stems from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) (ZDI Advisory).

This vulnerability allows local attackers to disclose sensitive information on affected installations of Trend Micro Apex One. When combined with other vulnerabilities, an attacker could potentially escalate privileges and execute code in the context of SYSTEM (ZDI Advisory).

Trend Micro has released an update to address this vulnerability. Users are advised to apply the security update available through the official Trend Micro channels (ZDI Advisory).