CVE-2020-8467 Trend Micro Apex One and OfficeScan Remote Code Execution
Remote attackers with valid credentials can execute arbitrary code on Trend Micro Apex One and OfficeScan XG installations via a migration tool vulnerability.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8467?
CVE-2020-8467 is a high-severity code injection vulnerability in Trendmicro Apex One, published on 18 Mar 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
Which versions are affected by CVE-2020-8467?
It affects 2 products.
Products include Trendmicro Apex One, Trendmicro Officescan.
How do I fix CVE-2020-8467?
No fix has been published for CVE-2020-8467 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-8467 being exploited?
Yes. Attackers have exploited CVE-2020-8467 in the wild since at least 3 Nov 2021.
Other vulnerabilities in Trendmicro Apex One
- CVE-2020-8599 Trend Micro Apex One and OfficeScan Authentication Bypass
- CVE-2025-54948 Trend Micro Apex One OS Command Injection
- CVE-2021-36741 Trend Micro Multiple Products Improper Input Validation
- CVE-2020-8468 Trend Micro Multiple Products Content Validation Escape
- CVE-2021-36742 Trend Micro Multiple Products Improper Input Validation
Sources
Also known as GHSA-fj9h-545h-php8.