CVE-2021-25248: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

An out-of-bounds read information disclosure vulnerability (CVE-2021-25248) was discovered in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10.0 SP1 and Services). The vulnerability was disclosed on February 4, 2021, and could allow an attacker to disclose sensitive information about a named pipe (CVE Details).

The specific vulnerability exists within TmCCSF.exe component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 2.5 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a low severity rating (ZDI Advisory).

If successfully exploited, this vulnerability could allow an attacker to disclose sensitive information about a named pipe. The impact is limited to information disclosure with no direct impact on system integrity or availability (CVE Details).

To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. This prerequisite significantly reduces the ease of exploitation (ZDI Advisory).

Trend Micro has issued updates to correct this vulnerability. Affected users should apply the appropriate patches for their specific product version (ZDI Advisory).