CVE-2020-28573: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

An improper access control information disclosure vulnerability (CVE-2020-28573) was discovered in Trend Micro Apex One and OfficeScan XG SP1. This vulnerability could allow an unauthenticated user to connect to the product server and reveal the total number of agents managed by the server (NVD, CVE).

The vulnerability exists within the web console, which listens on TCP port 4343 by default. The specific flaw results from improper access control implementation. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating it is network accessible, requires low attack complexity, needs no privileges or user interaction, and can result in low confidentiality impact (ZDI).

When exploited, this vulnerability allows remote attackers to disclose sensitive information from affected installations. Specifically, an attacker can obtain information about the total number of agents being managed by the server, which could be valuable for reconnaissance purposes (ZDI).

The vulnerability can be exploited remotely by an unauthenticated attacker. No authentication is required to exploit this vulnerability, making it relatively straightforward to exploit (ZDI).

Trend Micro has issued an update to correct this vulnerability. Users of affected products (Trend Micro Apex One and OfficeScan XG SP1) should apply the security updates provided by the vendor (ZDI).