9.9crit
CVE-2016-9269in critical feed1 exploit
Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) versio…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
13.4%
percentile 96%
Public exploits
1
Exploit-DB
Summary
Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update functionality. This was resolved in Version 6.5 CP 1737.
Exploit prediction (EPSS)
13.42% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
Exploits and detections
- EDB-41361 Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities · webapps · 2016-11-28
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
References
- securityfocus.com /bid/96252 · vdb-entry, x_refsource_BID, x_transferred
- success.trendmicro.com /solution/1116672 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1037849 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2016-9269
- NVD: CVE-2016-9269
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.