CVE-2017-11393

Critical

Published: 03/08/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The flaw can be exploited by parsing the tr parameter within Proxy.php.

Risk Assessment

Exploitation of this vulnerability could lead to full system compromise, posing a serious threat to organizational security.

Recommendation

It is recommended to update to the latest version of Trend Micro OfficeScan to mitigate this vulnerability and to monitor systems for unauthorized activity.

Original NVD description (English source)

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543.