7.2
CVE-2020-8607
- EPSS 0.08%
- Published 05.08.2020 14:15:13
- Last modified 21.11.2024 05:39:07
- Source security@trendmicro.com
- Teams watchlist Login
- Open Login
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
Data is provided by the National Vulnerability Database (NVD)
Trendmicro ≫ Antivirus Toolkit Version < 1.62.1240
Trendmicro ≫ Apex One Version2019
Trendmicro ≫ Apex One Versionsaas
Trendmicro ≫ Deep Security Version9.6
Trendmicro ≫ Deep Security Version10.0
Trendmicro ≫ Deep Security Version11.0
Trendmicro ≫ Deep Security Version12.0
Trendmicro ≫ Officescan Versionxg Updatesp1
Trendmicro ≫ Officescan Business Security Version9.0
Trendmicro ≫ Officescan Business Security Version9.5
Trendmicro ≫ Officescan Business Security Version10.0 Updatesp1
Trendmicro ≫ Officescan Business Security Service Version-
Trendmicro ≫ Officescan Cloud Version15
Trendmicro ≫ Officescan Cloud Version16.0
Trendmicro ≫ Online Scan Version8.0
Trendmicro ≫ Portable Security Version2.0
Trendmicro ≫ Portable Security Version3.0
Trendmicro ≫ Rootkit Buster Version2.2
Trendmicro ≫ Safe Lock Version- SwEditiontxone
Trendmicro ≫ Safe Lock Version2.0 Updatesp1 SwEdition-
Trendmicro ≫ Serverprotect Version5.8 SwPlatformemc
Trendmicro ≫ Serverprotect Version5.8 SwPlatformnetware
Trendmicro ≫ Serverprotect Version5.8 SwPlatformwindows
Trendmicro ≫ Serverprotect Version6.0 SwPlatformstorage
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.08% | 0.211 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.7 | 0.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.2 | 3.9 | 10 |
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.