{"id":"CVE-2020-24557","published":"2020-09-01T19:15:11Z","modified":"2026-06-17T03:05:45Z","title":"Trend Micro Multiple Products Improper Access Control Vulnerability","vendor":"Trend Micro","product":"Apex One, OfficeScan, and Worry-Free Business Security","tier":"core","eol":null,"description":{"text":"A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper access control issue in Trend Micro's Apex One and Worry-Free Business Security 10.0 SP1 products on Microsoft Windows, where a particular product folder can be manipulated. An attacker who already has the ability to run low-privileged code on the target system can abuse this to disable the security product temporarily and escalate privileges through a specific Windows function, though Windows 10 version 1909 (OS Build 18363.719) mitigates hard links and earlier versions are affected.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:20Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.02666,"percentile":0.85731,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-24557","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-04-21","exploitedFirstSeen":"2021-04-21","ransomware":false,"evidence":[{"url":"https://www.jpcert.or.jp/english/at/2021/at210020.html","date":"2021-04-21"},{"url":"https://therecord.media/hackers-tried-to-exploit-two-zero-days-in-trend-micros-apex-one-edr-platform","date":"2021-08-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://success.trendmicro.com/solution/000263632","tags":["Vendor Advisory"]},{"url":"https://success.trendmicro.com/solution/000267260","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1094/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://success.trendmicro.com/solution/000263632","tags":["Vendor Advisory"]},{"url":"https://success.trendmicro.com/solution/000267260","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1094/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-24557","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Local low-privilege attacker exploits for privilege escalation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability","start":271,"end":403}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-17276","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-17276","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2020-09-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24557","provenance":"source"},{"date":"2021-04-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.jpcert.or.jp/english/at/2021/at210020.html","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-17276","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":428},"priority":{"score":57.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2020 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.15,"detail":"percentile 0.8573"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}