Vulnerability Description
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-494: Update files are not properly verified.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Trendmicro | Antivirus\+ 2019 | <= 15.0 |
| Trendmicro | Internet Security 2019 | <= 15.0 |
| Trendmicro | Maximum Security 2019 | <= 15.0 |
| Trendmicro | Officescan Cloud | 15 |
| Trendmicro | Premium Security 2019 | <= 15.0 |
| Microsoft | Windows | - |
Related Weaknesses (CWE)
References
- https://helpcenter.trendmicro.com/en-us/article/TMKA-09890Vendor Advisory
- https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673Vendor Advisory
- https://jvn.jp/en/jp/JVN60093979/Third Party Advisory
- https://jvn.jp/jp/JVN60093979/Third Party Advisory
- https://helpcenter.trendmicro.com/en-us/article/TMKA-09890Vendor Advisory
- https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673Vendor Advisory
- https://jvn.jp/en/jp/JVN60093979/Third Party Advisory
- https://jvn.jp/jp/JVN60093979/Third Party Advisory
FAQ
What is CVE-2020-15604?
CVE-2020-15604 is a vulnerability with a CVSS score of 7.5 (HIGH). An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another at...
How severe is CVE-2020-15604?
CVE-2020-15604 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15604?
Check the references section above for vendor advisories and patch information. Affected products include: Trendmicro Antivirus\+ 2019, Trendmicro Internet Security 2019, Trendmicro Maximum Security 2019, Trendmicro Officescan Cloud, Trendmicro Premium Security 2019.