CVE-2021-25240: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

An improper access control vulnerability identified as CVE-2021-25240 was discovered in multiple Trend Micro security products, including Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1. The vulnerability was reported to the vendor on August 26, 2020, and was publicly disclosed on January 29, 2021 (ZDI Advisory, CVE Details).

The vulnerability exists within the web console, which listens on TCP port 4343 by default. The specific flaw stems from improper access control implementation that could allow an unauthenticated user to obtain x64 agent hofitx information. The vulnerability has been assigned a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) (ZDI Advisory).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro products. An attacker can leverage this vulnerability to disclose information from the application without requiring authentication (ZDI Advisory).

The vulnerability can be exploited remotely by an unauthenticated attacker. No user interaction is required for exploitation, making it relatively straightforward to exploit given the network access to the target system (ZDI Advisory).

Trend Micro has issued updates to correct this vulnerability. Users of affected products should apply the appropriate patches as detailed in the vendor's security advisory (ZDI Advisory).