CVE-2017-11386 - SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll

Back Back to CVE browser

CRITICAL

SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll

Published Aug 2, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 24.10%

Description

SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll. Formerly ZDI-CAN-4549.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

http://www.securityfocus.com/bid/100078
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1039049
vdb-entryx_refsource_SECTRACK
http://www.zerodayinitiative.com/advisories/ZDI-17-496
x_refsource_MISCThird Party AdvisoryVDB Entry
https://success.trendmicro.com/solution/1117722
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/100078		vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1039049		vdb-entryx_refsource_SECTRACK
http://www.zerodayinitiative.com/advisories/ZDI-17-496		x_refsource_MISCThird Party AdvisoryVDB Entry
https://success.trendmicro.com/solution/1117722		x_refsource_MISCPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner trendmicro

Published Aug 2, 2017

Updated Aug 5, 2024

Reserved Jul 17, 2017

Link CVE-2017-11386

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-11386

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-11386