CVE-2017-14083

published 2017-10-06

CVE-2017-14083: A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encryption file.

Priority P2 58 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encryption file.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
trend_micro	trend_micro_officescan	—	—
trendmicro	officescan	—	—
trendmicro	officescan	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 4343↗

filename crypt.key↗

path ../repository/inc/class/common/crypt/crypt.key↗

• → Monitor for unauthenticated HTTP/HTTPS requests to the OfficeScan server on port 4343 that result in download of the crypt.key file, particularly requests traversing to the path /../repository/inc/class/common/crypt/crypt.key. ↗
• → Alert on any outbound transfer of a 32-byte file named crypt.key from the OfficeScan server, as the disclosed key file is exactly 32 bytes in size. ↗

• · The crypt.key file path is defined in config.php and resolves relative to the OfficeScan web root; defenders should verify this path on their installation to ensure file-access controls are correctly applied. ↗
• · The vulnerability affects OfficeScan v11.0 and XG (12.0); both versions expose the same crypt.key file to unauthenticated remote access. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.