CVE-2017-11386
9.8
CRITICAL · CVSS 3.0 · EPSS 24.1% (pctl 98)
Patch early
EPSS 24.1% — above the 10% action threshold.
Description
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll. Formerly ZDI-CAN-4549.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 24.1% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2017-08-02 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| trendmicro | control manager |
References
- http://www.securityfocus.com/bid/100078
- http://www.securitytracker.com/id/1039049
- http://www.zerodayinitiative.com/advisories/ZDI-17-496
- https://success.trendmicro.com/solution/1117722
- http://www.securityfocus.com/bid/100078
- http://www.securitytracker.com/id/1039049
- http://www.zerodayinitiative.com/advisories/ZDI-17-496
- https://success.trendmicro.com/solution/1117722
→ the Explorer · watch your stack · NVD