CVE-2016-3987

published 2016-04-12

CVE-2016-3987: The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1)…

Priority P2 78 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB.

Detection & IOCs extracted from sources · hover to see the quote

url api/openUrlInDefaultBrowser↗

url api/showSB↗

port 49155↗

command topWindow.require('child_process').spawn('cmd', [ '/c', '<cmd>' ])↗

• · The exploit iterates through ports starting at 49155, so the exact listening port is not fixed — detection rules must account for a range of high ports beginning at 49155. ↗
• · The attacker cannot send single-quote characters directly in the command parameter; the exploit encodes the payload via character codes (charCodeAt), so detection of the encoded form may be necessary. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284