CVE-2016-6267
HighSummary
SnmpUtils in Trend Micro Smart Protection Server before specified builds allows remote authenticated users to execute arbitrary commands via shell metacharacters in the admin_notification.php parameters.
Risk Assessment
An attacker could exploit this vulnerability to execute remote code, potentially leading to system compromise.
Recommendation
It is recommended to update Trend Micro Smart Protection Server to the latest version to mitigate this vulnerability.
Other vulnerabilities in Trend Micro Smart Protection Server
See all- CVE-2016-6268High
Trend Micro Smart Protection Server versions 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allow local web server users to execute arbitrary code with root privileges via a Trojan horse .war file in the Solr webapps directory.
- CVE-2016-6266High
In ccca_ajaxhandler.php in Trend Micro Smart Protection Server before version 2.5 build 2200, 2.6 build 2106, and 3.0 build 1330, remote authenticated users can execute arbitrary commands via shell metacharacters in the host or apikey parameters in a register action, enable parameter in a save_stting action, or host or apikey parameters in a test_connection action.
Original NVD description (English source)
SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3) spare_AllowGroupNetmask parameter to admin_notification.php.