CVE-2016-7552

🗓️ 12 Apr 2017 10:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 116 Views🌐 WEB

Trend Micro Threat Discovery Appliance 2.6.1062r1 session_id cookie directory traversal vulnerabilit

Reporter	Title	Published	Views	Family All 24
0day.today	Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_dlp.cgi Remote Code Execution Exploit	20 Apr 201700:00	–	zdt
0day.today	Trend Micro Threat Discovery Appliance 2.6.1062r1 log_query_dae.cgi Remote Code Execution Exploit	20 Apr 201700:00	–	zdt
0day.today	Trend Micro Threat Discovery Appliance 2.6.1062r1 logoff.cgi Directory Traversal Exploit	20 Apr 201700:00	–	zdt
ATTACKERKB	CVE-2016-7552	12 Apr 201710:59	–	attackerkb
BDU FSTEC	The vulnerability of the microprogramming software of the Trend Micro Threat Discovery Appliance lies in the improper restriction on the path to the restricted access catalog. This allows a malicious actor to delete arbitrary files with root privileges, bypass authentication procedures, or cause service failures.	23 Nov 201700:00	–	bdu_fstec
Circl	CVE-2016-7552	29 May 201815:50	–	circl
CNVD	Trend Micro Threat Discovery Appliance Directory Traversal Vulnerability (CNVD-2017-10698)	24 May 201700:00	–	cnvd
Check Point Advisories	Trendmicro Threat Discovery Appliance Directory Traversal (CVE-2016-7552)	22 Dec 202000:00	–	checkpoint_advisories
Cvelist	CVE-2016-7552	12 Apr 201710:00	–	cvelist
Metasploit	Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution	10 Apr 201718:32	–	metasploit

NVD

Node

trendmicro threat_discovery_applianceMatch2.6.1062r1

Source	Link
securityfocus	www.securityfocus.com/bid/97599
github	www.github.com/rapid7/metasploit-framework/pull/8216/commits/0f07875a2ddb0bfbb4e985ab074e9fc56da1dcf6

Parameter	Position	Path	Description	CWE
passwd	request body	/cgi-bin/logon.cgi	Directory traversal vulnerability enabling pre-authenticated access by manipulating session context to bypass authentication.	CWE-22
isCookieEnable	request body	/cgi-bin/logon.cgi	Directory traversal vulnerability enabling pre-authenticated access by manipulating session context to bypass authentication.	CWE-22
session_id	header	/cgi-bin/logoff.cgi	Directory traversal via session_id cookie allowing deletion of arbitrary files as root to bypass authentication or cause DoS.	CWE-22

17 Jun 2026 00:53Current

9.4High risk

Vulners AI Score9.4

CVSS 39.8

CVSS 210

EPSS0.93249

cve-2016-7552 trend micro threat discovery appliance directory traversal session_id vulnerability remote attacker unauthenticated authentication bypass dos