« Back to list

CVE-2020-28573

Status: ModifiedMedium (5.3)—

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal the total agents managed by the server.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Trendmicro — Apex ONETrendmicro — Officescan

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2020-28573",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Trend Micro",
          "product": "Trend Micro Apex One",
          "versions": [
            {
              "status": "affected",
              "version": "2019"
            }
          ]
        },
        {
          "vendor": "Trend Micro",
          "product": "Trend Micro OfficeScan",
          "versions": [
            {
              "status": "affected",
              "version": "XG SP1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-12-01T19:15:11.837",
  "references": [
    {
      "url": "https://success.trendmicro.com/solution/000281947",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "https://success.trendmicro.com/solution/000281949",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1374/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "https://success.trendmicro.com/solution/000281947",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://success.trendmicro.com/solution/000281949",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1374/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal the total agents managed by the server."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de divulgación de información de control de acceso inapropiado en Trend Micro Apex One y OfficeScan XG SP1, podría permitir a un usuario no autenticado conectarse al servidor del producto y revelar el total de agentes administrados por el servidor"
    }
  ],
  "lastModified": "2026-06-17T03:10:33.370",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF019D2D-C426-4D2D-A254-442CE777B41E"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64600B42-4884-41F2-A683-AE1EDB79372E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@trendmicro.com"
}