Trend Micro announced on Tuesday that it has patched several flaws in its Apex One endpoint security product, including a zero-day vulnerability.
The exploited vulnerability is tracked as CVE-2022-40139 and it has been described as an improper validation issue related to the product’s rollback function. This high-severity vulnerability can only be exploited by an attacker who is able to log into the product’s admin console.
The attacker can instruct affected clients to download an unverified rollback package, which could lead to remote code execution, according to an advisory released by Trend Micro.
“Since the attacker must have previously stolen the authentication information for the product’s management console, it is not possible to infiltrate the target network using this vulnerability alone,” the cybersecurity firm explained in a Japanese-language advisory.
No information is available on the attacks exploiting CVE-2022-40139, and Trend Micro told SecurityWeek that it’s not disclosing any details.
It’s not uncommon for threat actors to exploit vulnerabilities in Trend Micro products, with several attacks being reported in the past few years. The security holes appear to have mostly been exploited in targeted attacks, and in some cases Chinese threat actors have been confirmed as the main suspect.
In addition to the zero-day vulnerability, the Apex One patches also address three other high-severity and two medium-severity issues.
The most serious of them is CVE-2022-40144, which could allow an attacker to bypass authentication using specially crafted requests. In theory, it may be possible to chain such vulnerabilities with the aforementioned zero-day to achieve the authentication requirement, but Trend Micro has not mentioned anything about CVE-2022-40144 being exploited in attacks.
The other vulnerabilities patched by Trend Micro can be exploited for privilege escalation, DoS attacks, and obtaining information about a targeted server.
According to CISA’s Known Exploited Vulnerabilities Catalog, eight other Trend Micro flaws have been exploited in the wild in the past years, most of which impact Apex products.
*updated with link and information from English-language advisory. Also added that Trend Micro is not sharing information about the attacks
Related: Trend Micro Confirms In-the-Wild Zero-Day Attacks
Related: Trend Micro OfficeScan Flaw Apparently Exploited in Mitsubishi Electric Hack
Related: Trend Micro Patches Vulnerabilities in Hybrid Cloud Security Products
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
