CVE-2020-28577: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

An improper access control information disclosure vulnerability (CVE-2020-28577) was discovered in Trend Micro Apex One and OfficeScan XG SP1. This vulnerability, disclosed on November 22, 2020, could allow an unauthenticated user to connect to the product server and reveal sensitive information including server hostname and database names (ZDI Advisory, NVD).

The vulnerability exists within the web console, which listens on TCP port 4343 by default. The specific flaw results from improper access control implementation. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and no requirements for privileges or user interaction (ZDI Advisory, NVD).

When exploited, this vulnerability allows remote attackers to disclose sensitive information from the affected installations. Specifically, attackers can obtain server hostname and database names from the target system, which could potentially be used for further attacks or reconnaissance (ZDI Advisory).

The vulnerability can be exploited remotely by an unauthenticated attacker. No special privileges or user interaction is required to exploit this vulnerability, making it relatively straightforward to exploit (ZDI Advisory).

Trend Micro has issued an update to correct this vulnerability. Users of affected products (Trend Micro Apex One and OfficeScan XG SP1) should apply the security updates provided by the vendor (ZDI Advisory).