Trend Micro antivirus zero-day used in Mitsubishi Electric hack

[WalterSobchak]

https://www.zdnet.com/article/trend-micro-antivirus-zero-day-used-in-mitsubishi-electric-hack/

[ENOTTY]

> A source with knowledge of the attack told ZDNet that the hackers exploited CVE-2019-18187, a directory traversal and arbitrary file upload vulnerability in the Trend Micro OfficeScan antivirus.

Security software is like any other software in that it needs to obey the principle of least privilege.