CVE-2021-36741: Trend Micro OfficeScan Auth Bypass Flaw

CVE-2021-36741 Overview

CVE-2021-36741 is an improper input validation vulnerability affecting multiple Trend Micro security products, including Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1. This vulnerability allows authenticated attackers to upload arbitrary files to affected systems through the product's management console, potentially leading to remote code execution and complete system compromise.

The vulnerability stems from insufficient validation of file uploads within the management console interface. While exploitation requires valid credentials to access the console, once authenticated, an attacker can leverage this flaw to upload malicious files, including webshells or executable payloads.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Organizations using affected Trend Micro products should prioritize immediate patching.

Affected Products

• Trend Micro Apex One 2019
• Trend Micro OfficeScan XG SP1
• Trend Micro Worry-Free Business Security 10.0 SP1
• Trend Micro Apex One as a Service
• Microsoft Windows (as underlying platform)

Discovery Timeline

• July 29, 2021 - CVE-2021-36741 published to NVD
• October 31, 2025 - Last updated in NVD database

Technical Details for CVE-2021-36741

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The improper input validation in Trend Micro's endpoint security products allows authenticated users to bypass file upload restrictions within the management console. The flaw exists in the file handling mechanism that fails to properly validate the type and content of uploaded files.

The vulnerability requires network access and low privileges (authenticated console access), but once these prerequisites are met, exploitation requires no user interaction. An attacker who successfully exploits this vulnerability can achieve high impact on confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause lies in insufficient server-side validation of file uploads within the product's management console. The application fails to properly verify file types, extensions, and content before accepting uploads, allowing attackers to upload files with dangerous types such as executable scripts or webshells. This represents a critical input validation failure in a security-sensitive administrative interface.

Attack Vector

The attack vector is network-based, requiring the attacker to first obtain valid credentials for the product's management console. The attack flow typically involves:

1. The attacker gains access to the Trend Micro management console credentials through credential theft, phishing, or other means
2. Using authenticated access, the attacker identifies the vulnerable file upload functionality
3. The attacker crafts a malicious file, such as a webshell or reverse shell payload
4. By exploiting the improper input validation, the malicious file is uploaded to the server
5. The attacker then accesses or triggers the uploaded file to achieve code execution

The vulnerability mechanism involves bypassing file upload restrictions by manipulating requests to the management console's file handling endpoints. Detailed technical analysis is available in the Trend Micro Security Advisories.

Detection Methods for CVE-2021-36741

Indicators of Compromise

• Unexpected file uploads to Trend Micro product directories, particularly webshells or script files
• Anomalous authentication attempts followed by file upload activities in management console logs
• New or modified files in web-accessible directories of the Trend Micro installation
• Unusual outbound network connections originating from the Trend Micro server process

Detection Strategies

• Monitor management console authentication logs for unusual login patterns or access from unexpected IP addresses
• Implement file integrity monitoring on Trend Micro installation directories to detect unauthorized file additions
• Configure web application firewall rules to detect and block suspicious file upload payloads
• Review HTTP POST requests to management console endpoints for anomalous file types or sizes

Monitoring Recommendations

• Enable verbose logging on the Trend Micro management console and forward logs to a SIEM solution
• Set up alerts for multiple failed authentication attempts followed by successful login to the management console
• Monitor for processes spawned by the Trend Micro server that deviate from normal operational behavior
• Implement network segmentation and monitor traffic between management console and other network segments

How to Mitigate CVE-2021-36741

Immediate Actions Required

• Apply the latest security patches from Trend Micro immediately as this vulnerability is actively exploited
• Restrict network access to the Trend Micro management console to authorized administrator IP addresses only
• Review console access logs for any suspicious activity that may indicate prior exploitation
• Conduct a file system audit to identify any unauthorized files uploaded to the Trend Micro installation

Patch Information

Trend Micro has released security patches addressing this vulnerability. Organizations should apply the relevant updates based on their product deployment:

• Trend Micro Solution #000287819 - Apex One and OfficeScan security update
• Trend Micro Solution #000287820 - Additional security guidance
• Trend Micro Solution #000287796 (JP) - Japanese language advisory
• Trend Micro Solution #000287815 (JP) - Japanese language advisory

For CISA KEV compliance requirements, refer to the CISA Known Exploited Vulnerabilities entry for CVE-2021-36741.

Workarounds

• Implement strict network access controls limiting management console access to a dedicated management VLAN
• Enable multi-factor authentication for all administrative access to the console where supported
• Deploy a web application firewall in front of the management console to filter malicious upload attempts
• Consider temporarily disabling remote console access until patches can be applied, using local console access only

# Example: Restrict management console access via Windows Firewall
# Limit access to specific administrator IP addresses
netsh advfirewall firewall add rule name="Restrict Trend Micro Console" dir=in action=allow protocol=tcp localport=4343 remoteip=10.0.0.50,10.0.0.51
netsh advfirewall firewall add rule name="Block Trend Micro Console Default" dir=in action=block protocol=tcp localport=4343