CVE-2020-24557
Trend Micro Multiple Products Improper Access Control Vulnerability
Description
CVE-2020-24557 is a high-severity improper access control vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows. The vulnerability allows a local attacker to manipulate a particular product folder to temporarily disable security protections, abuse a specific Windows function, and achieve privilege escalation. An attacker must first gain the ability to execute low-privileged code on the target system before exploiting this vulnerability. CISA has confirmed active exploitation by listing CVE-2020-24557 in the Known Exploited Vulnerabilities catalog. With an EPSS score of 1.88% (82.92nd percentile), this vulnerability has a measurable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trendmicro | apex one | -; 2019 |
| trendmicro | worry-free business security | 10.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://success.trendmicro.com/solution/000263632(Vendor Advisory)
- https://success.trendmicro.com/solution/000267260(Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-20-1094/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-24557(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2020-24557 in the NVD database. The vulnerability involves improper access control over a product folder that allows an attacker to manipulate security settings and escalate privileges through abuse of Windows functionality. The core issue is inadequate file system permission controls on security-critical product directories.
Impact Analysis
CVE-2020-24557 carries a CVSS 3.1 score of 7.8 (HIGH), representing a significant local privilege escalation threat. The vulnerability requires local access with low attack complexity and low-level privileges, but no user interaction is needed. Confidentiality (High) is fully impacted, as privilege escalation grants access to all data accessible to higher-privileged accounts. Integrity (High) allows the attacker to modify system files, security configurations, and application data with elevated permissions. Availability (High) enables disruption of security services and system operations. Although the attack vector is local rather than network-based, the ability to disable endpoint security protections and escalate privileges makes this vulnerability particularly dangerous in post-compromise scenarios where an attacker has already gained initial access. Notably, Microsoft Windows 10 version 1909 (OS Build 18363.719) mitigates the hard link abuse used in this exploit, but earlier Windows versions remain vulnerable.
Exploit Maturity
CVE-2020-24557 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 1.88% (82.92nd percentile) indicates a measurable probability of exploitation. A detailed technical analysis is available through the Zero Day Initiative advisory (ZDI-20-1094), which provides additional exploit context. The vulnerability is particularly attractive for post-exploitation scenarios where attackers use it to escalate privileges and disable security monitoring after gaining initial access through other means.
Remediation
- Apply vendor patches immediately as required by CISA KEV. Install security updates from Trend Micro for Apex One (including version 2019) and Worry-Free Business Security 10.0 SP1 as documented in the vendor advisories.
- Verify that all Trend Micro Apex One and Worry-Free Business Security installations on Windows systems have been updated. Check both the management server and all deployed agents for proper patch status.
- Ensure that Microsoft Windows systems running the affected Trend Micro products are updated to at least Windows 10 version 1909 (OS Build 18363.719) or later, which provides operating system-level mitigation against the hard link abuse technique used in this exploit.
- Review file system permissions on Trend Micro product installation directories to ensure they follow the principle of least privilege, preventing low-privileged users from manipulating security-critical product folders.
- Deploy endpoint detection and response (EDR) monitoring to detect privilege escalation attempts, including suspicious folder manipulation, hard link creation in product directories, and unexpected changes to security service configurations.
Technical Details
CVE-2020-24557 exploits an improper access control vulnerability in the file system permissions of Trend Micro Apex One and Worry-Free Business Security product folders on Microsoft Windows. The attack involves manipulating a particular product folder to temporarily disable security protections, then abusing a specific Windows function (related to hard links) to achieve privilege escalation. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires local access and low-level privileges, with low complexity and no user interaction. The scope is unchanged, meaning exploitation affects the local system. A key technical detail is that Microsoft Windows 10 version 1909 (OS Build 18363.719) introduced mitigations for hard link abuse, which effectively prevents this specific exploitation technique on updated Windows systems. However, organizations running older Windows versions remain fully vulnerable. The attack chain requires the attacker to first obtain low-privileged code execution on the target system, making this primarily a privilege escalation vulnerability used in multi-stage attacks.
Frequently Asked Questions
Is CVE-2020-24557 being actively exploited?
Yes. CVE-2020-24557 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 1.88% (82.92nd percentile) indicates a measurable exploitation probability. The Zero Day Initiative has published an advisory (ZDI-20-1094) providing additional technical context.
What products are affected by CVE-2020-24557?
CVE-2020-24557 affects Trend Micro Apex One (including version 2019) and Trend Micro Worry-Free Business Security 10.0 SP1, specifically on Microsoft Windows. Systems running Windows 10 version 1909 or later have partial mitigation through hard link protections.
How do I fix CVE-2020-24557?
Apply security updates from Trend Micro for Apex One and Worry-Free Business Security. Additionally, ensure Windows systems are updated to at least version 1909 (OS Build 18363.719) for operating system-level mitigation. Review and restrict file system permissions on product installation directories.
How severe is CVE-2020-24557?
CVE-2020-24557 has a CVSS 3.1 score of 7.8 (HIGH). It enables local privilege escalation by disabling security protections and abusing Windows functionality. While local access is required, the ability to disable endpoint security makes it a valuable tool for attackers in post-compromise scenarios.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.