CVE-2020-8468

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents had a content validation escape vulnerability allowing attackers to manipulate agent client components.

The vulnerability allowed attackers to manipulate certain agent client components, potentially leading to unauthorized access or control of the security software itself. For DIB organizations, this means their endpoint security could be compromised, undermining their defense posture and violating CMMC/NIST 800-171 requirements for protecting information systems. Organizations should verify patch levels and consider alternative vendors if the vulnerability remains unpatched.

Shame score — A content validation escape in security software is a severe failure that attackers can exploit to manipulate the very tools meant to protect the network, representing a high-avoidability negligence given the critical nature of the affected products.