CVE-2020-28578

published 2020-11-18

CVE-2020-28578: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted…

Priority P2 77 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
trend_micro	trend_micro_interscan_web_security_virtual_appliance	—	—
trendmicro	interscan_web_security_virtual_appliance	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /rest/windows_client_status↗

port 8443↗

command curl -ski -d 'ip=localhost&basic=true&encry=false&password='$(python -c "print 'A'*0x1000") https:// :8443/rest/windows_client_status↗

url /urlf_reclassifyurl.jsp↗

url /uilogonsubmit.jsp↗

url /servlet/com.trend.iwss.gui.servlet.ManageVLANSettings↗

• → Detect unauthenticated POST requests to /rest/windows_client_status on port 8443 with an oversized 'password' parameter (e.g., >1024 bytes), indicative of CVE-2020-28578 stack buffer overflow exploitation. ↗
• → The vulnerable function is Java_com_trend_iwss_gui_IWSSJNI_DecryptPasswd in libuiauutil.so; exploitation results in a stack overflow via strcpy with attacker-controlled data from the 'password' POST parameter. ↗
• → Successful exploitation runs code as the 'iscan' account; monitor for unexpected processes spawned by iscan following requests to /rest/windows_client_status. ↗
• → Monitor POST requests to /urlf_reclassifyurl.jsp with an oversized 'sender_addr' parameter (>16384 bytes) as an indicator of CVE-2020-28579 exploitation. ↗
• → Monitor POST requests to /servlet/com.trend.iwss.gui.servlet.ManageVLANSettings for shell metacharacters in VLAN-related parameters, indicative of CVE-2020-28580 command injection via the AddVLANItem function. ↗
• → The command injection in AddVLANItem passes attacker-controlled input to system() via snprintf with format string '%s addVLANItem %s' and the shell script /usr/iwss/AdminUI/ui_ctl.sh; monitor for unexpected child processes of ui_ctl.sh. ↗

• · CVE-2020-28578 is unauthenticated — no session cookie or credentials are required to trigger the stack buffer overflow via /rest/windows_client_status, making it the highest-severity issue in this advisory. ↗
• · CVE-2020-28579 (MailNotification stack overflow) requires authentication but only a low-privileged 'reports only' user account, lowering the bar for exploitation. ↗
• · CVE-2020-28580 (AddVLANItem command injection) requires a high-privileged account to reach /servlet/com.trend.iwss.gui.servlet.ManageVLANSettings. ↗
• · All three vulnerabilities affect Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 Service Pack 2, build 1901 specifically. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787