CVE-2016-9269

Critical

Published: 21/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier has a remote command execution vulnerability. Authenticated users with least privileges can run arbitrary commands on the system as root via the Patch Update functionality.

Risk Assessment

This vulnerability could lead to serious security breaches, allowing attackers to remotely take control of the system. It may result in data loss or unauthorized access to organizational resources.

Recommendation

It is recommended to upgrade to version 6.5 CP 1737 or later to mitigate this vulnerability. Additionally, access to the patch update functionality should be monitored and restricted.

Original NVD description (English source)

Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update functionality. This was resolved in Version 6.5 CP 1737.