Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-9269 — Interscan WEB Security Virtual Appliance vulnerability

CWE-2644 documents4 sources
Severity
9.9CRITICALNVD
EPSS
6.8%
top 8.62%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Trendmicro Interscan WEB Security Virtual Appliance
Timeline
PublishedFeb 21
Latest updateMay 17

Description

Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update functionality. This was resolved in Version 6.5 CP 1737.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 3.1 | Impact: 6.0

Affected Packages1 packages

Patches

Patch: success.trendmicro.com ↗Patch: success.trendmicro.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7j52-9cgp-5hf2: Remote Command Execution in com↗2022-05-17
▶
CVEList
CVE-2016-9269: Remote Command Execution in com↗2017-02-21
▶

💥Exploits & PoCs

1
Exploit-DB
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities↗2016-11-28
▶
CVE-2016-9269 — Trendmicro vulnerability | cvebase