CVE-2016-6270 The handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote authenticated users to execute arbitrary...
HighCVSS 8.8
EPSS 6.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to api/v1/cfg/oauth/save_identify_pfx/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trendmicro virtual mobile infrastructure | = 5.0 | No fix listed |
References
- 95884 third-party-advisory vdb-entry
- qkaiser.github.io exploit technical-description third-party-advisory
- success.trendmicro.com vendor-advisory