Vulnerability in Microsoft Windows
CVE-2020-15602
An untrusted search path remote code execution (RCE) vulnerability in the Trend Micro Secuity 2020 (v16.0.0.1146 and below) consumer family of products could allow an attacker to run arbitrary code on a vulnerable system. As the Trend Micro installer tries to load DLL files from its current directory, an arbitrary DLL could also be loaded with the same privileges as the installer if run as Administrator. User interaction is required to exploit the vulnerbaility in that the target must open a malicious directory or device.
EPSS: 0.010 (59.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- security@trendmicro.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-15602?
- CVE-2020-15602 is a high-severity vulnerability in Microsoft Windows, classified under Untrusted Search Path. CVSS score: 7.8/10. Published 2020-07-15.
- How severe is CVE-2020-15602?
- High severity. CVSS v3 base score is 7.8 out of 10.