CVE-2016-6267 SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metac...
HighCVSS 8.8
EPSS 54.9%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3) spare_AllowGroupNetmask parameter to admin_notification.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trendmicro smart protection server | = 2.5 | No fix listed |
| trendmicro smart protection server | = 2.6 | No fix listed |
| trendmicro smart protection server | = 3.0 | No fix listed |
References
- qkaiser.github.io exploit technical-description third-party-advisory
- success.trendmicro.com mitigation patch vendor-advisory