RCE in Trend Micro Smart Protection Server (Standalone)
CVE-2017-14094
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a cron job injection on a vulnerable system.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.563 (98.1th percentile) — read the EPSS interpretation.
Affected products
- Trend Micro Smart Protection Server (Standalone) — versions 3.0, 3.1, 3.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- 43388 (exploit, x_refsource_EXPLOIT-DB)
- 102275 (vdb-entry, x_refsource_BID)
- success.trendmicro.com/solution/1118992 (x_refsource_CONFIRM)
- www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vu… (x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-14094?
- CVE-2017-14094 is a vulnerability in Trend Micro Smart Protection Server (Standalone), classified under OS Command Injection. Published 2018-01-19.
- Is CVE-2017-14094 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.