CVE-2016-8584
9.8
CRITICAL · CVSS 3.0 · EPSS 5.6% (pctl 93)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 5.57% — more likely to be exploited than 93% of all CVEs |
| Weakness | CWE-284 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2017-04-28 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| trendmicro | threat discovery appliance |
References
- http://packetstormsecurity.com/files/142227/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-Session-Generation-Authentication-Bypass.html
- http://www.securityfocus.com/bid/98333
- http://packetstormsecurity.com/files/142227/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-Session-Generation-Authentication-Bypass.html
- http://www.securityfocus.com/bid/98333
→ the Explorer · watch your stack · NVD