CVE-2021-25243: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

An improper access control vulnerability was discovered in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1. The vulnerability was assigned CVE-2021-25243 and was disclosed on January 29, 2021. This security flaw affects the web console component, which typically listens on TCP port 4343 (ZDI Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in low-level information disclosure (NVD).

When successfully exploited, this vulnerability allows unauthenticated remote attackers to obtain patch level information from affected installations. The issue stems from improper access control implementation in the system (ZDI Advisory).

The vulnerability can be exploited remotely by unauthenticated attackers. No user interaction is required for exploitation, and the attack complexity is considered low. The vulnerability was reported to Trend Micro on September 2, 2020, and was publicly disclosed on January 29, 2021 (ZDI Advisory).

Trend Micro has released updates to address this vulnerability. Users of affected products should apply the appropriate patches available through the vendor's security advisory (ZDI Advisory).