VULNERABILITY INTELLIGENCE

CVE-2018-6231

CVSS score9.8 CRITICAL

EPSS probability6.95%

CISA KEVNot currently listed

Published2018-03-15

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A server auth command injection authentication bypass vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.3 and below could allow remote attackers to escalate privileges on vulnerable installations.

Weakness classification

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references

security@trendmicro.com — Vendor Advisory
security@trendmicro.com — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry