by Kastro
Paper/Archive/CVE-2022-26871

CVE-2022-26871

Trend Micro Trend Micro Apex Central — Trend Micro Apex Central Arbitrary File Upload Vulnerability

KEV · due 21 AprEPSS 19%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 97.4.974 × 2019.5Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.

Affected

ProductAffectedFixed inSource
Trend Micro Apex Central2019 (on-premise), SaaS–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsuccess.trendmicro.com/solution/000290678refsuccess.trendmicro.com/jp/solution/000290660refjpcert.or.jp/english/at/2022/at220008.htmlrefjvn.jp/vu/JVNVU99107357refappweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26871kevcisa.gov/known-exploited-vulnerabilities-catalog