CVE-2021-32464
📋 TL;DR
This vulnerability allows local privilege escalation in Trend Micro security products. An attacker with low-privileged code execution can modify scripts before they run to gain higher privileges. Affects Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security Services.
💻 Affected Systems
- Trend Micro Apex One
- Trend Micro Apex One as a Service
- Trend Micro Worry-Free Business Security Services
📦 What is this software?
Apex One by Trendmicro
Officescan by Trendmicro
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing installation of malware, data theft, and persistence mechanisms.
Likely Case
Local privilege escalation to SYSTEM/root level, enabling lateral movement, disabling security controls, and establishing persistence.
If Mitigated
Limited impact if proper access controls prevent initial low-privileged code execution and script modification.
🎯 Exploit Status
Requires local access and ability to execute low-privileged code first. ZDI advisory exists but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Multiple patches available - check specific product advisory for exact version
Vendor Advisory: https://success.trendmicro.com/solution/000286857
Restart Required: Yes
Instructions:
1. Identify affected product and version. 2. Download appropriate patch from Trend Micro support portal. 3. Apply patch following vendor instructions. 4. Restart system as required.
🔧 Temporary Workarounds
Restrict script modification permissions
windowsApply strict file permissions to prevent unauthorized modification of Trend Micro scripts
icacls "C:\Program Files\Trend Micro\*" /deny Users:(W)
🧯 If You Can't Patch
- Implement strict access controls to prevent low-privileged code execution
- Monitor for unauthorized script modifications and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Trend Micro product version against patched versions in vendor advisoriesCheck Version:
Check product console or registry: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\[ProductName]\VersionVerify Fix Applied:
Verify product version matches or exceeds patched version listed in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unauthorized file modifications in Trend Micro directories
- Unexpected privilege escalation events
- Script execution with elevated privileges
Network Indicators:
- Unusual outbound connections from Trend Micro processes
- Lateral movement attempts from Trend Micro systems
SIEM Query:
EventID=4688 AND (ProcessName LIKE '%Trend Micro%' OR ParentProcessName LIKE '%Trend Micro%') AND NewProcessName NOT LIKE '%Trend Micro%'🔗 References
- https://success.trendmicro.com/jp/solution/000287796
- https://success.trendmicro.com/solution/000286857
- https://success.trendmicro.com/solution/000287819
- https://www.zerodayinitiative.com/advisories/ZDI-21-910/
- https://success.trendmicro.com/jp/solution/000287796
- https://success.trendmicro.com/solution/000286857
- https://success.trendmicro.com/solution/000287819
- https://www.zerodayinitiative.com/advisories/ZDI-21-910/
