CVE-2020-15604

Vulnerability

Trend Micro Security 2019 (v15) and earlier Windows consumer products (Premium Security, Maximum Security, Internet Security, Antivirus+) contain an incomplete SSL server certification validation vulnerability (CWE-494) in the Active Update function. The update files are not properly verified, which could allow an attacker to combine this flaw with another attack (CVE-2020-24560) to serve a malicious update instead of the legitimate one. [1][2][4]

Exploitation

An attacker must be in a position to perform a man-in-the-middle (MITM) attack, for example by placing a rogue wireless LAN access point. The attacker then intercepts the update request from the affected client and delivers a specially crafted update file. No authentication or user interaction is required beyond the normal update process. [1][3]

Impact

Successful exploitation allows the attacker to execute arbitrary code with SYSTEM privilege on the target system. This gives full control over the affected Windows machine. [1][3]

Mitigation

Trend Micro released fixes in version 16 (build 16.0.1405 or later) and version 17 (build 17.0.1150 or later) starting September 2019. Users should upgrade to Trend Micro Security 2020 (v16) or 2021 (v17). No workarounds are provided; no KEV listing found. [2][4]