CVE-2016-8587

Severity: high (CVSS 7.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-04-28 · updated 2026-06-17
Weakness: CWE-284

Description

dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.

Affected products

Trendmicro Threat Discovery Appliance: through 2.6.1062

References

http://packetstormsecurity.com/files/142221/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-dlp_policy_upload.cgi-Remote-Code-Execution.html
http://www.securityfocus.com/bid/98508
http://packetstormsecurity.com/files/142221/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-dlp_policy_upload.cgi-Remote-Code-Execution.html
http://www.securityfocus.com/bid/98508

Get alerted when CVE-2016-8587 or the next vulnerability affects your stack