CVE-2020-28581 - A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges

Back Back to CVE browser

HIGH

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges

Published Nov 18, 2020

7.2

HIGH

CVSS 3.1

EPSS 44.95%

Description

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.

Affected products

Vendor Trend Micro Product Trend Micro InterScan Web Security Virtual Appliance Default
n/a
- Version
  6.5 SP2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Trend Micro

Trend Micro InterScan Web Security Virtual Appliance

n/a

Version	Status	Constraints
6.5 SP2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://success.trendmicro.com/solution/000281954
x_refsource_MISCVendor Advisory
https://www.tenable.com/security/research/tra-2020-63
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://success.trendmicro.com/solution/000281954		x_refsource_MISCVendor Advisory
https://www.tenable.com/security/research/tra-2020-63		x_refsource_MISCExploitThird Party Advisory