CVE-2022-25329

CWE-798 — Hard-coded Credentials3 documents3 sources
Severity
9.8CRITICAL
EPSS
2.6%
top 14.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Trend Micro Trend Micro Serverprotect FOR EMC CelerraTrend Micro Trend Micro Serverprotect FOR Microsoft Windows / Novell NetwareTrend Micro Trend Micro Serverprotect FOR Network Appliance Filers+4 more
Timeline
PublishedFeb 24
Latest updateFeb 25

Description

Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An unauthenticated remote attacker with access to the Information Server could exploit this to register to the server and perform authenticated actions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶NVDtrendmicro/serverprotect5.8, 6.0+1

Patches

Patch: success.trendmicro.com ↗Patch: success.trendmicro.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4m4r-x763-43q2: Trend Micro ServerProtect 6↗2022-02-25
▶
CVEList
CVE-2022-25329: Trend Micro ServerProtect 6↗2022-02-24
▶
CVE-2022-25329 (CRITICAL CVSS 9.8) | Trend Micro ServerProtect 6.0/5.8 I | cvebase.io