CVE-2016-8588
HighSummary
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the integrity and confidentiality of the system.
Recommendation
It is recommended to upgrade to the latest version of Trend Micro Threat Discovery Appliance to mitigate this vulnerability.
Other vulnerabilities in Trend Micro Threat Discovery Appliance
See all- CVE-2016-8593High
Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
- CVE-2016-8592High
In Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, the log_query_system.cgi script allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8591High
In log_query.cgi of Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, remote authenticated users can execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8590High
The log_query_dlp.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8589High
The log_query_dae.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8587High
The vulnerability in dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to specified locations.
- CVE-2016-8586High
In Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier, remote authenticated users can execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
- CVE-2016-8585High
The admin_sys_time.cgi in Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
- CVE-2016-8584Critical
Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier uses predictable session values, allowing remote attackers to bypass authentication by guessing the value.
- CVE-2016-7552Critical
The Trend Micro Threat Discovery Appliance 2.6.1062r1 has a directory traversal vulnerability that allows a remote, unauthenticated attacker to delete arbitrary files as root by processing a session_id cookie. This can be exploited to bypass authentication or cause a DoS.
Original NVD description (English source)
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.