CVE-2021-31520

CVE-2021-31520 describes a weak session token authentication bypass vulnerability affecting Trend Micro IM Security versions 1.6 and 1.6.5. A remote attacker could exploit this by guessing an administrator's session token to gain unauthorized access to the product's web management interface. This vulnerability carries a high CVSS score of 8.1, indicating a severe risk with high confidentiality, integrity, and availability impacts, requiring no user interaction for exploitation. While the EPSS score is low, suggesting a lower likelihood of exploitation compared to many CVEs, there is currently no public exploit code or evidence of active exploitation, and it has received minimal community discussion or media coverage.