Content validation bypass in Trend Micro security agents

Successful exploitation permits manipulation of affected security-agent components and code execution through malicious updates. An observed attack chain combined CVE-2019-9489 with CVE-2020-8468 against internet-exposed Trend Micro deployments to deliver ShadowPad to selected endpoints and support further intrusion into internal networks. The execution privilege level and specific confidentiality or availability consequences are not established.

If immediate patching is not possible, restrict access to administrative and authenticated interfaces involved in agent management and content delivery, enforce strong authentication for product administration, and limit which users and systems can publish or influence agent updates. Monitor for anomalous agent update activity, unexpected changes to endpoint security client components, and suspicious code execution originating from security product processes. Network segmentation and least-privilege controls around management infrastructure can reduce the blast radius of exploitation.

Apply Trend Micro's patches for CVE-2020-8468, released in March 2020, to affected deployments. Exact fixed build numbers are not available. Deployments susceptible to the observed two-vulnerability attack chain should also remediate CVE-2019-9489.