CVE-2016-8592
high
CVSS v3
8.8
CVSS v2
9.0
VIR risk
8.8
Description
log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| trendmicro | threat_discovery_appliance | {"endIncluding":"2.6.1062"} | |
References
- http://packetstormsecurity.com/files/142216/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_system.cgi-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/98345
- http://packetstormsecurity.com/files/142216/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_system.cgi-Remote-Code-Execution.html
- http://www.securityfocus.com/bid/98345
CWEs
CWE-264
Verify integrity in audit chain (admin only). AS-IS.