Login Request a demo
High severity · published May 26, 2017
CVE-2017-9035
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers
7.4
CVSS
3.6%
EPSS
No
On KEV
Description
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Serverprotect · Trendmicro
3.0 · source: NVD
Affected product
SE
Serverprotect
Trendmicro
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9035
Exploit
http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html
Exploit
http://seclists.org/fulldisclosure/2017/May/91
Third Party Advisory
http://www.securitytracker.com/id/1038548
Patch
https://success.trendmicro.com/solution/1117411
Exploit
https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilities
More from Serverprotect
9.8
CVE-2022-25330
Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the process or achieve remote code execution
9.8
CVE-2022-25329
Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console
9.8
CVE-2021-36745
A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers 5.8, and ServerProtect for Microsoft…
9.8
CVE-2017-9034
Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges by leveraging…
9.1
CVE-2020-24561
A command injection vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow an attacker to execute arbitrary code on an affected system