CVE-2016-5840

Published: Jun 30, 2016Modified: May 6, 2026

7.2

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.

Affected (3)

Products: Trend Micro: Deep Discovery Inspector

Trend Micro

1 product

Deep Discovery Inspector

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Trend Micro Deep Discovery Inspector	Version 3.7
Trend Micro Deep Discovery Inspector	Version 3.81
Trend Micro Deep Discovery Inspector	Version 3.82

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://esupport.trendmicro.com/solution/en-US/1114281.aspx

Source: cve@mitre.org

Vendor Advisory

http://jvn.jp/en/jp/JVN55428526/index.html

Source: cve@mitre.org

http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000103.html

Source: cve@mitre.org

http://www.zerodayinitiative.com/advisories/ZDI-16-373

Source: cve@mitre.org

https://www.exploit-db.com/exploits/40180/

Source: cve@mitre.org

ExploitThird Party Advisory

http://esupport.trendmicro.com/solution/en-US/1114281.aspx