LiveActive security incident?Get immediate response
CVE Record

CVE-2021-32462: Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Exposed Hazardous...

Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Exposed Hazardous Function Remote Code Execution vulnerability which could allow an unprivileged client to manipulate the registry and escalate privileges to SYSTEM on affected installations. Authentication is required to exploit this vulnerability.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Older Trend Micro Password Manager consumer installations can let an authenticated, low-privileged client abuse exposed functionality to alter Windows registry data and gain SYSTEM privileges. This turns a normal user account on an affected machine into full control of that device. The source bundle does not provide CVSS scoring or evidence of active exploitation.

Executive priority

Treat this as a high-priority endpoint hygiene issue where the product exists. It is not supported as internet-wide emergency exploitation by the provided sources, but SYSTEM-level compromise on user devices can enable credential theft, persistence, and broader business impact.

Technical view

CVE-2021-32462 is an exposed hazardous function remote code execution issue in Trend Micro Password Manager Consumer 5.0.0.1217 and below. The provided description says an unprivileged client can manipulate the registry and escalate privileges to SYSTEM. Authentication is required. No CWE, CVSS vector, or root-cause detail is included in the bundle.

Likely exposure

Exposure is limited to endpoints running Trend Micro Password Manager Consumer version 5.0.0.1217 or below. The bundle does not state server exposure, default install prevalence, or whether enterprise Trend Micro products are affected.

Exploitation context

Authentication is required, and the described outcome is local privilege escalation to SYSTEM through registry manipulation. The bundle marks CISA KEV as false and provides no cited evidence of active exploitation or public exploit availability.

Researcher notes

Key gaps remain: no CVSS, CWE, exploitability detail, patch version, or complete technical root cause is present in the source bundle. Analysis should stay bounded to Trend Micro Password Manager Consumer 5.0.0.1217 and below unless vendor advisory evidence expands scope.

Mitigation direction

  • Inventory endpoints for Trend Micro Password Manager Consumer installations.
  • Identify versions at or below 5.0.0.1217.
  • Check Trend Micro advisory TMKA-10388 for vendor remediation guidance.
  • Upgrade or remove affected installations according to vendor guidance.
  • Prioritize devices shared by multiple users or exposed to untrusted users.

Validation and detection

  • Confirm installed product name and version on sampled endpoints.
  • Verify whether any installation is version 5.0.0.1217 or below.
  • Check vulnerability management tools for CVE-2021-32462 detections.
  • Review vendor advisory status before closing remediation tickets.
  • Document any unsupported or non-remediated affected hosts.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-32462 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Trend MicroTrend Micro Password Manager5.0.0.1217 and belowListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.