CVE-2016-7547
CriticalSummary
A command execution flaw exists in the Trend Micro Threat Discovery Appliance 2.6.1062r1 with the timezone parameter in the admin_sys_time.cgi interface.
Risk Assessment
This vulnerability may allow an attacker to execute commands remotely, potentially leading to device takeover.
Recommendation
It is recommended to update the software to the latest version and monitor access to the admin_sys_time.cgi interface.
Other vulnerabilities in Trend Micro Threat Discovery Appliance 2.6.1062r1
See all- CVE-2016-8593High
Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
- CVE-2016-8592High
In Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, the log_query_system.cgi script allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8591High
In log_query.cgi of Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, remote authenticated users can execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8590High
The log_query_dlp.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8589High
The log_query_dae.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8588High
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
- CVE-2016-8587High
The vulnerability in dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to specified locations.
- CVE-2016-8586High
In Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, remote authenticated users can execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8585High
The admin_sys_time.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
- CVE-2016-8584Critical
Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier uses predictable session values, allowing remote attackers to bypass authentication by guessing the value.
Original NVD description (English source)
A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.