CVE-2017-11394

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544.

Score

CVSS 3.0 9.8 Critical

Status

Modified - security@trendmicro.com

Published

2017-08-03

Last modified

2024-09-16

Weaknesses

CWE-20

Affected products

• Trend Micro Officescan (Trend Micro)
• Officescan (Trendmicro)

References

• http://www.securityfocus.com/bid/100130
• http://www.zerodayinitiative.com/advisories/ZDI-17-521
• https://success.trendmicro.com/solution/1117769
• https://www.exploit-db.com/exploits/42971/