VULNERABILITY INTELLIGENCE
CVE-2017-11395
CVSS score8.8 HIGH
EPSS probability14.09%
CISA KEVNot currently listed
Published2017-09-22
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers with authenticated access to execute arbitrary code on vulnerable installations.
Weakness classification
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Primary references
- security@trendmicro.com — Exploit, Third Party Advisory
- security@trendmicro.com — Third Party Advisory, VDB Entry
- security@trendmicro.com — Mitigation, Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Patch, Vendor Advisory