Security restrictions bypass in Threat Discovery Appliance - CVE-2016-7552

Vulnerability identifier: #VU7991

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-7552

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to conduct a directory traversal attack on the target system.

The weakness exists in the logoff.cgi script due to improper processing of a session_id cookie. A remote attacker can send specially crafted data, delete arbitrary files in the logoff.cgi script, reset the administrator password to 'admin' if the system is rebooted and bypass authentication restrictions or cause DoS condition.

Successful exploitation of the vulnerability may result in system crash.

Threat Discovery Appliance

Install update from vendor's website.

• Exploit #1751 - Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution (March 18, 2020)

• https://dl.packetstormsecurity.net/1704-exploits/tmtda261062rllo-traversal.txt

• Security restrictions bypass in Trend Micro Threat Discovery Appliance