Trend Micro Apex One and Worry-Free Business Security Improper Input Validation Local Privilege Escalation (CVE-2021-36742)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-36742) is an improper input validation flaw (CWE-20) existing in Trend Micro's endpoint security solutions, including Apex One, OfficeScan, and Worry-Free Business Security. The root cause lies in the failure of high-privileged agent components to properly validate input parameters passed from local processes or users. This allows low-privileged local attackers to manipulate inputs to execute arbitrary actions with elevated privileges.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first gain local access and the ability to execute low-privileged code on the target system. Once local execution is established, the attacker sends crafted inputs to the vulnerable Trend Micro service via IPC channels or registry/file path manipulations. Because the Trend Micro agent service runs with SYSTEM privileges, the lack of input validation allows the service to load malicious libraries or execute arbitrary commands, resulting in full local privilege escalation.

3. Infrastructure & Business Impact

As this vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, it represents a highly active threat vector. Endpoint security agents run with the highest privileges on enterprise workstations and servers. Compromising these agents allows attackers to bypass local security controls, disable monitoring, and establish a foothold for lateral movement and ransomware deployment across the corporate network.