VulnerabilityModified
CVE-2017-11386
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll.
CRITICAL 9.8EPSS 24.1%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 24.1%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll. Formerly ZDI-CAN-4549.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 24.10% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- trendmicro/control manager
- Source
- security@trendmicro.com
References
- http://www.securityfocus.com/bid/100078
- http://www.securitytracker.com/id/1039049
- http://www.zerodayinitiative.com/advisories/ZDI-17-496Third Party Advisory, VDB Entry
- https://success.trendmicro.com/solution/1117722Patch, Vendor Advisory
- http://www.securityfocus.com/bid/100078
- http://www.securitytracker.com/id/1039049
- http://www.zerodayinitiative.com/advisories/ZDI-17-496Third Party Advisory, VDB Entry
- https://success.trendmicro.com/solution/1117722Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.