VIR Vulnerability Intelligence Relay

CVE-2017-11393

critical
Published 2017-08-03 · Modified 2026-05-13
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
10.0
VIR risk
9.8

Description

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security@trendmicro.com — https://success.trendmicro.com/solution/1117769

Application impact
VendorProductVersionsFixed
trendmicroofficescan11.0
trendmicroofficescan12.0

References

CWEs

CWE-20

Verify integrity in audit chain (admin only). AS-IS.