CVE-2021-25238 Information disclosure in Trend Micro OfficeScan

What is CVE-2021-25238?

CVE-2021-25238 is a medium-severity vulnerability in Trendmicro Officescan, published on 4 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An improper access control information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about an agent's managing port.

Which versions are affected by CVE-2021-25238?

It affects 2 products.

Products include Trendmicro Officescan, Trendmicro Worry-Free Business Security.

How do I fix CVE-2021-25238?

No fix has been published for CVE-2021-25238 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-25238 being exploited?

There is no known exploitation of CVE-2021-25238 in the wild and no public exploit code.

Other vulnerabilities in Trendmicro Officescan

• CVE-2019-18187 Trend Micro OfficeScan Directory Traversal Exploited High 8.8
• CVE-2017-14089 Memory corruption in Trend Micro OfficeScan Critical 9.8
• CVE-2017-11393 Command injection in Trend Micro OfficeScan Critical 9.8
• CVE-2017-11394 Command injection in Trend Micro OfficeScan Critical 9.8
• CVE-2018-10508 Privilege escalation in Trend Micro OfficeScan High 8.8

All Trendmicro Officescan vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7p7v-2fpp-9q7j.