Actively exploited in the wild
Trend Micro OfficeScan Directory Traversal Vulnerability
Trend Micro - OfficeScan · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-18187
HighCVSS 7.5KEVSummary
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.
Risk Assessment
An authenticated attacker could exploit this vulnerability to achieve remote code execution on the OfficeScan server, potentially leading to system compromise.
Recommendation
Update Trend Micro OfficeScan to the latest version and restrict access to the management interface.
Other vulnerabilities in Trend Micro OfficeScan
Original NVD description (English source)
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.