Improper input validation in Microsoft Windows
CVE-2020-8607
An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (43.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 43.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Microsoft Windows
- Trend Micro Anti-Threat Toolkit (Attk) — versions 1.62.1240 and below
- Trend Micro Apex One — versions 2019 (On premise), SaaS
- Trend Micro Deep Security — versions 12.x, 11.x. 10.x
- Trend Micro Housecall — versions 8.0
- Trend Micro Officescan — versions XG SP1
- Trend Micro Portable Security — versions 3.x, 2.x
- Trend Micro Rootkit Buster — versions 2.2
- Trend Micro Safe Lock — versions 2.0 SP1, TXOne Ed
- Trend Micro Security (Consumer Family) — versions 2020 (v16), 2019 (v15)
Weakness classification (CWE)
References
- success.trendmicro.com/solution/000260713 (Patch, Vendor Advisory)
- success.trendmicro.com/jp/solution/000260748 (Vendor Advisory)
- jvn.jp/vu/JVNVU99160193/ (Third Party Advisory)
- jvn.jp/en/vu/JVNVU99160193/index.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-8607?
- CVE-2020-8607 is a medium-severity vulnerability in Microsoft Windows, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2020-08-05.
- How severe is CVE-2020-8607?
- Medium severity. CVSS v3 base score is 6.7 out of 10.