CVE-2016-7552
On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
- Affected products
- Trend Micro Threat Discovery Appliance
- Trendmicro Threat Discovery Appliance
- = 2.6.1062
- CVSS 2.0
- 10.0 HIGH
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 93.2% (100th percentile)
- Weakness
- CWE-22
- NVD status
- Modified
- Published
- 2017-04-12
CVE-2016-7552 at NVD
14 known exploits for CVE-2016-7552
Proof-of-concept code and exploit modules indexed by Sploitus
Trend Micro Threat Discovery Appliance <= 2.6.1062r1 log_query_dlp.cgi Command Injection Remote Code Execution Vulnerability (CVE-2016-8590)
Trend Micro Threat Discovery Appliance <= 2.6.1062r1 log_query_dae.cgi Command Injection Remote Code Execution Vulnerability (CVE-2016-8589)
Trend Micro Threat Discovery Appliance <= 2.6.1062r1 logoff.cgi Directory Traversal Authentication Bypass Vulnerability（CVE-2016-7552）
Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_dae.cgi Remote Code Execution Exploit
Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_dlp.cgi Remote Code Execution Exploit
Trend Micro Threat Discovery Appliance 2.6.1062r1 logoff.cgi Directory Traversal Exploit
Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_dlp.cgi Remote Code Execution
Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_dae.cgi Remote Code Execution
Trend Micro Threat Discovery Appliance 2.6.1062r1 logoff.cgi Directory Traversal
Trend Micro Threat Discovery Appliance - Session Generation Authentication Bypass (CVE-2016-8584)
Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution
Trend Micro Threat Discovery Appliance arbitrary files deletion (CVE-2016-7552)
Trend Micro Threat Discovery Appliance remote code execution（CVE-2016-7547）
Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution