CVE-2021-36742
Trend Micro Multiple Products Improper Input Validation Vulnerability
Description
CVE-2021-36742 is a high-severity improper input validation vulnerability affecting multiple Trend Micro products including Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security. The vulnerability allows a local attacker who has already gained low-privileged code execution on the target system to escalate privileges on affected installations. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 1.87% (82.9th percentile), there is a notable probability of exploitation activity targeting this flaw.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trendmicro | officescan | xg |
| trendmicro | officescan business security | 10.0 |
| trendmicro | apex one | 2019 |
| trendmicro | worry-free business security | 10.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://success.trendmicro.com/jp/solution/000287796(Vendor Advisory)
- https://success.trendmicro.com/jp/solution/000287815(Vendor Advisory)
- https://success.trendmicro.com/solution/000287819(Vendor Advisory)
- https://success.trendmicro.com/solution/000287820(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36742(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation occurs when a product does not properly validate input before processing it, allowing attackers to craft inputs that can alter control flow, access unauthorized resources, or trigger unexpected behavior. In the context of CVE-2021-36742, the Trend Micro endpoint security agents fail to validate certain inputs, enabling a local attacker to escalate from low-privileged access to higher privilege levels on the affected system.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2021-36742 carries a CVSS 3.1 score of 7.8 (HIGH), indicating a significant local privilege escalation threat. The vulnerability requires local access with low privileges and no user interaction, meaning any attacker who has achieved initial code execution on a system running affected Trend Micro software can escalate to higher privilege levels. Successful exploitation impacts confidentiality, integrity, and availability at the highest level, potentially granting the attacker full control over the compromised endpoint. Organizations relying on Trend Micro Apex One, OfficeScan XG, or Worry-Free Business Security as their endpoint protection platform face a compounded risk, as compromising the security agent itself may disable protective controls while simultaneously granting elevated access.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-36742 by listing it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-11-17. The EPSS score of 1.87% (82.9th percentile) indicates a measurable exploitation probability. While no specific public exploit code or proof-of-concept was identified in the tracked references, the confirmed active exploitation in the wild demonstrates that threat actors have developed working exploits for this privilege escalation vulnerability.
Remediation
- Apply vendor patches immediately as required by the CISA KEV directive: Apply updates per vendor instructions. Trend Micro has published security advisories with specific patches for all affected products.
- Update all affected products to their latest patched versions: Trend Micro Apex One (2019), OfficeScan XG, OfficeScan Business Security 10.0, and Worry-Free Business Security 10.0. Verify patch deployment across all managed endpoints.
- Implement application whitelisting and endpoint detection controls to monitor for unauthorized privilege escalation attempts on systems running Trend Micro agents.
- Review system logs and endpoint telemetry for signs of local privilege escalation, including unexpected process creation with elevated privileges, modifications to security agent configurations, or attempts to disable endpoint protection.
- Harden endpoint security by enforcing least-privilege access policies, ensuring that standard user accounts cannot interact with or modify Trend Micro agent components, and implementing additional input validation at the operating system level where possible.
Technical Details
CVE-2021-36742 is rooted in improper input validation (CWE-20) within the agent components of Trend Micro Apex One (2019), OfficeScan XG, OfficeScan Business Security 10.0, and Worry-Free Business Security 10.0 SP1. The vulnerability allows a local attacker with low-privileged code execution to supply crafted input that the agent fails to properly validate, resulting in privilege escalation on the affected system. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires local access with low privileges but no user interaction, and the impact is contained within the scope of the vulnerable component while affecting all three security pillars at the highest severity. The attacker must first establish a foothold on the target system through another means before leveraging this vulnerability for privilege escalation.
Frequently Asked Questions
Is CVE-2021-36742 being actively exploited?
Yes. CVE-2021-36742 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 1.87% (82.9th percentile) indicates a notable exploitation probability. There is no known association with ransomware campaigns at this time.
What products are affected by CVE-2021-36742?
CVE-2021-36742 affects Trend Micro Apex One (2019), Trend Micro OfficeScan XG, Trend Micro OfficeScan Business Security 10.0, and Trend Micro Worry-Free Business Security 10.0. All products contain agent components that are vulnerable to improper input validation leading to privilege escalation.
How do I fix CVE-2021-36742?
Apply the vendor-provided patches immediately as directed by Trend Micro's security advisories. Update all affected endpoint agents to the latest patched versions. Additionally, monitor endpoints for signs of privilege escalation and implement least-privilege access controls.
How severe is CVE-2021-36742?
CVE-2021-36742 has a CVSS 3.1 score of 7.8 (HIGH). While the attack requires local access and low privileges, successful exploitation grants full control over the compromised endpoint, including high impact on confidentiality, integrity, and availability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.