Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2020-24557

CVE-2020-24557HIGH

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0267   85.5   YES

AFFECTED
  Product                                   Versions                   Fixed
  Trend Micro Apex One                      2009 (on premise), SaaS –  —
  Trend Micro Worry-Free Business Security  10.0 SP1 –                 —

TIMELINE
  Aug 20  Reserved by trendmicro
  Sep 1   Published (CNA: trendmicro)
  Nov 3   Added to CISA KEV, remediation due 2022-05-03

CNA: trendmicro · CVSS v3.1 · 4 references · KEV due May 3, 2022

Description

A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 20, 2020	Reserved	Reserved by trendmicro
September 1, 2020	Published	Published (CNA: trendmicro)
November 3, 2021	KEV ADDED	Added to CISA KEV, remediation due 2022-05-03

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Trend Micro	Trend Micro Apex One	—	2009 (on premise), SaaS	—
Trend Micro	Trend Micro Worry-Free Business Security	—	10.0 SP1	—

References (4)

https://success.trendmicro.com/solution/000263632 [x_refsource_MISC]
https://success.trendmicro.com/solution/000267260 [x_refsource_MISC]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-24557 [government-resource]
https://www.zerodayinitiative.com/advisories/ZDI-20-1094/ [x_refsource_MISC]

Authoritative record: CVE-2020-24557 at cve.org

Vendors: trend micro

About this page