CVE-2020-8607

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-05 · updated 2026-06-17
Weakness: CWE-20

Description

An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection driver could allow an attacker in user-mode with administrator permissions to abuse the driver to modify a kernel address that may cause a system crash or potentially lead to code execution in kernel mode. An attacker must already have obtained administrator access on the target machine (either legitimately or via a separate unrelated attack) to exploit this vulnerability.

Affected products

Trendmicro Antivirus Toolkit: before 1.62.1240 — fixed in 1.62.1240
Trend Micro Apex One: 2019, saas
Trend Micro Deep Security Agent: 9.6, 10.0, 11.0, 12.0
Trend Micro OfficeScan: xg-sp1
Trendmicro Officescan Business Security: 9.0, 9.5, 10.0-sp1
Trendmicro Officescan Business Security Service: all versions
Trendmicro Officescan Cloud: 15, 16.0
Trendmicro Online Scan: 8.0
Trend Micro Portable Security: 2.0, 3.0
Trendmicro Rootkit Buster: 2.2
Trendmicro Safe Lock: 2.0-sp1
Trend Micro ServerProtect for Linux: 5.8, 6.0

How to fix

Upgrade to a fixed version: Trendmicro Antivirus Toolkit 1.62.1240. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-8607 or the next vulnerability affects your stack