CVE-2021-28646: 
Trend Micro Apex One Agent vulnerability analysis and mitigation

An insecure file permissions vulnerability was identified in Trend Micro Apex One, Apex One as a Service, and OfficeScan XG SP1. The vulnerability, tracked as CVE-2021-28646, was disclosed on April 13, 2021, and could allow a local attacker to take control of a specific log file on affected installations (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource) (NVD).

If exploited, this vulnerability allows a local attacker to gain control over specific log files in affected installations, potentially leading to unauthorized file manipulation (NVD).

The vulnerability requires local access and low privileges to exploit. The attack complexity is considered low, and no user interaction is required for exploitation (NVD).

Affected users should apply the appropriate security updates provided by Trend Micro. The specific patches include CP 9204 for Apex One, the 202103 update for Apex One (SaaS), and CP 6046 for OfficeScan XG SP1 (CERT-FR).