CVE-2021-25230: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

An improper access control vulnerability (CVE-2021-25230) was discovered in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1. The vulnerability was disclosed on January 29, 2021, and could allow an unauthenticated user to obtain information about the contents of a scan connection exception file (ZDI Advisory, NVD).

The vulnerability exists within the web console, which listens on TCP port 4343 by default. The specific flaw results from improper access control implementation. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and no required privileges or user interaction (ZDI Advisory, NVD).

The vulnerability allows remote attackers to disclose sensitive information from the application. Specifically, an unauthenticated user could obtain information about the contents of a scan connection exception file (ZDI Advisory).

The vulnerability can be exploited remotely by an unauthenticated attacker. No user interaction is required for exploitation, and the attack complexity is considered low (NVD).

Trend Micro has issued an update to correct this vulnerability. Users should apply the latest security patches provided by the vendor (ZDI Advisory).