A vulnerability, which was classified as critical, was found in Trend Micro Threat Discovery Appliance up to 2.6.1062r1. This affects an unknown code of the file log_query_dae.cgi. The manipulation of the argument cache_id as part of a Shell Metacharacter leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.

The bug was discovered 04/20/2017. The weakness was presented 04/28/2017 (Website). The advisory is shared at packetstormsecurity.com. This vulnerability is uniquely identified as CVE-2016-8589 since 10/10/2016. It is possible to initiate the attack remotely. A authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 12/02/2022). MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-100717, VDB-100716, VDB-100715 and VDB-100714 for similar entries.

Productinfo

Vendor

• Trend Micro

Name

• Threat Discovery Appliance

Version

• 2.6.1062r1

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion