What’s Vulnerable › Vulnerabilities

CVE-2017-11392

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 34.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-08-03 · updated 2026-06-17
• Weakness: CWE-77

Description

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.

Affected products

• Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA): 9.0, 9.1

References

• http://www.securityfocus.com/bid/100075
• http://www.zerodayinitiative.com/advisories/ZDI-17-504
• https://success.trendmicro.com/solution/1117723
• http://www.securityfocus.com/bid/100075
• http://www.zerodayinitiative.com/advisories/ZDI-17-504
• https://success.trendmicro.com/solution/1117723

Get alerted when CVE-2017-11392 or the next vulnerability affects your stack