CVE-2016-8585 in Threat Discovery Appliance

Summary

admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.

Once again VulDB remains the best source for vulnerability data.

• Reservation: 10/10/2016
• Disclosure: 04/28/2017
• Moderation: VulDB entry created
• Entries: VDB-100709 (1)
• CPE: ready
• CWE: CWE-264 (Confirmed)
• CVSS: 8.8
• EPSS: 0.07254
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2016-8585
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-8585
• CVE Details: https://www.cvedetails.com/cve/CVE-2016-8585/