CVE-2016-6267

high · 8.8

SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3) spare_AllowGroupNetmask parameter to admin_notification.php.

8.8

CVSS

54.9%

EPSS (exploit prob.)

99th

EPSS percentile

2017-01-30

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
trendmicro	smart_protection_server	2.5
trendmicro	smart_protection_server	2.6
trendmicro	smart_protection_server	3.0

Check a specific version with /api/v1/cve/match.

References

https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/
https://success.trendmicro.com/solution/1114913
https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/
https://success.trendmicro.com/solution/1114913

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-6267