CVE-2017-11394
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | The vulnerability of the Trend Micro OfficeScan antivirus protection allows a perpetrator to execute arbitrary code. | 18 Aug 201700:00 | – | bdu_fstec |
 | CVE-2017-11394 | 29 May 201815:50 | – | circl |
 | Trend Micro OfficeScan 'Proxy.php' Command Injection Vulnerability | 7 Aug 201700:00 | – | cnvd |
 | Trend Micro OfficeScan Proxy.php Command Injection (CVE-2017-11394) | 17 Aug 201700:00 | – | checkpoint_advisories |
| Trend Micro InterScan Messaging Security modTMCSS Command Injection (CVE-2017-11391; CVE-2017-11394) | 7 Nov 201700:00 | – | checkpoint_advisories |
 | CVE-2017-11394 | 3 Aug 201715:00 | – | cvelist |
 | Trend Micro OfficeScan Proxy.php RCE | 2 Sep 201700:00 | – | dsquare |
 | Trend Micro OfficeScan 11.0/XG (12.0) - Remote Code Execution (Metasploit) | 11 Oct 201700:00 | – | exploitdb |
 | Trend Micro OfficeScan Remote Code Execution | 8 Oct 201714:54 | – | metasploit |
 | CVE-2017-11394 | 3 Aug 201715:29 | – | nvd |
10
Node
OR
[
{
"product": "Trend Micro OfficeScan",
"vendor": "Trend Micro",
"versions": [
{
"status": "affected",
"version": "11, XG (12)"
}
]
}
]| Source | Link |
|---|---|
| securityfocus | www.securityfocus.com/bid/100130 |
| zerodayinitiative | www.zerodayinitiative.com/advisories/ZDI-17-521 |
| success | www.success.trendmicro.com/solution/1117769 |
| exploit-db | www.exploit-db.com/exploits/42971/ |
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| cid | request body | officescan/console/html/widget/ui/modLogin/talker.php | Authentication bypass in Talker.php due to invalid/unchecked parameters (ack/hash) enabling widget access. | CWE-20 |
| act | request body | officescan/console/html/widget/ui/modLogin/talker.php | Authentication bypass in Talker.php due to invalid/unchecked parameters (ack/hash) enabling widget access. | CWE-20 |
| hash | request body | officescan/console/html/widget/ui/modLogin/talker.php | Authentication bypass in Talker.php due to invalid/unchecked parameters (ack/hash) enabling widget access. | CWE-20 |
| pid | request body | officescan/console/html/widget/ui/modLogin/talker.php | Authentication bypass in Talker.php due to invalid/unchecked parameters (ack/hash) enabling widget access. | CWE-20 |
| module | request body | officescan/console/html/widget/proxy_controller.php | Command injection via Proxy_controller.php (modTMCSS) by manipulating TOP parameter used in system calls. | CWE-20 |
| serverid | request body | officescan/console/html/widget/proxy_controller.php | Command injection via Proxy_controller.php (modTMCSS) by manipulating TOP parameter used in system calls. | CWE-20 |
| TOP | request body | officescan/console/html/widget/proxy_controller.php | Command injection via Proxy_controller.php (modTMCSS) by manipulating TOP parameter used in system calls. | CWE-20 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 01:01Current
9.8High risk
Vulners AI Score9.8
CVSS 39.8
CVSS 210
EPSS0.66774