CVE-2020-28582: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

An improper access control information disclosure vulnerability (CVE-2020-28582) was discovered in Trend Micro Apex One and OfficeScan XG SP1. The vulnerability was reported on August 5, 2020, and publicly disclosed on November 27, 2020. This security flaw affects the web console component, which typically listens on TCP port 4343 (ZDI Advisory).

The vulnerability stems from improper access control within the web console. It has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited remotely without requiring authentication or user interaction, resulting in low-level information disclosure (NVD).

When successfully exploited, this vulnerability allows an unauthenticated remote attacker to connect to the product server and reveal the number of managed agents. The information disclosure could potentially provide attackers with valuable insights into the target environment's scale and deployment (ZDI Advisory).

The vulnerability can be exploited remotely by unauthenticated attackers through the web console interface. No user interaction is required for exploitation, making it relatively straightforward to exploit (ZDI Advisory).

Trend Micro has released security updates to address this vulnerability. Affected users should apply the appropriate patches provided by the vendor (ZDI Advisory).