Overview :
Vulnerable versions of ATTK may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.
Affected Product(s) :
  • Anti-Threat Toolkit (ATTK) 1.62.0.1218 and below
Vulnerability Details :
CVE ID : CVE-2019-9491
CVSS 3.0 Score(s): 7.5 – AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Solution :

Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.

However, even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to update to the latest builds as soon as possible.