CVE-2021-25232: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

An improper access control vulnerability (CVE-2021-25232) was discovered in Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1. The vulnerability was reported on August 7, 2020, and publicly disclosed on January 29, 2021. The affected products include Trend Micro Apex One 2019 and OfficeScan XG SP1 (ZDI Advisory, CVE Mitre).

The vulnerability exists within the web console, which listens on TCP port 4343 by default. The specific flaw results from improper access control implementation. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (NVD, ZDI Advisory).

When exploited, this vulnerability allows an unauthenticated remote attacker to obtain sensitive information about the SQL database. The impact is limited to information disclosure with no direct impact on system integrity or availability (NVD).

The vulnerability can be exploited remotely by an unauthenticated attacker. No user interaction is required for exploitation, making it relatively straightforward to exploit given the technical knowledge (ZDI Advisory).

Trend Micro has released security updates to address this vulnerability. Users of affected products should apply the appropriate patches: Apex One requires the CP9167 update, and OfficeScan XG SP1 requires the CP6040 update (ZDI Advisory).