CVE-2020-8466

A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.

Affected

Trend Micro · Trend Micro InterScan Web Security Virtual Appliance

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

64.08% chance of exploitation in the next 30 days, 99th percentile

Published

2020-12-17

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-t…

Security advisories

• https://success.trendmicro.com/solution/000283077
• https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-t…

References

• CVE Record
• NVD entry