Description
A DLL side-loading vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow an authenticated attacker to gain code execution and terminate the product's process - disabling endpoint protection. The attacker must have already gained authentication and have local access to the vulnerable system.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_misc
https://www.nsslabs.com/blog-posts/2019/7/24/your-advanced-endpoint-protection-aep-product-protects-your-computer-but-can-it-protect-itself
Patch, Vendor Advisory x_refsource_confirm
https://success.trendmicro.com/solution/1123045
Scores
CVSS v3
7.8
EPSS
0.0010
EPSS Percentile
28.0%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-426
Status
published
Products (2)
trendmicro/officescan
11.0 sp1
trendmicro/officescan
xg
Published
Jul 26, 2019
Tracked Since
Feb 18, 2026