CVE-2021-25251 Code injection in Trend Micro Security (Consumer)
An attacker with administrator privileges can inject code to disable password protection and security features in Trend Micro Security.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-25251?
CVE-2021-25251 is a high-severity code injection vulnerability in Trend Micro Security (Consumer), published on 10 Feb 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit this vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2021-25251?
It affects 8 products.
Products include Trendmicro Antivirus\+ Security 2020, Trendmicro Antivirus\+ Security 2021, Trendmicro Internet Security 2020, Trendmicro Internet Security 2021, Trendmicro Maximum Security 2020, Trendmicro Maximum Security 2021 and 2 more.
How do I fix CVE-2021-25251?
No fix has been published for CVE-2021-25251 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-25251 being exploited?
There is no known exploitation of CVE-2021-25251 in the wild and no public exploit code.
Other vulnerabilities in Trend Micro Security (Consumer)
- CVE-2019-18190 Null dereference in Trend Micro Security (Consumer)
- CVE-2020-27695 Privilege escalation in Trend Micro Security (Consumer)
- CVE-2020-27696 Privilege escalation in Trend Micro Security (Consumer)
- CVE-2020-27697 Privilege escalation in Trend Micro Security (Consumer)
- CVE-2019-19693 Path traversal in Trend Micro Security (Consumer)
Sources
Also known as GHSA-3pw2-j2vj-ghmp.