CVE-2017-11393
9.8
CRITICAL · CVSS 3.0 · EPSS 15.9% (pctl 97)
Patch early
EPSS 15.9% — above the 10% action threshold.
Description
Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 15.89% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2017-08-03 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| trendmicro | officescan |
References
→ the Explorer · watch your stack · NVD