CVE-2017-14095: trend micro trend micro smart protection server (standalone) PHP Remote File Inclusion

EPSS trend

Probability

12.48%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 12.48% on 19-09-2026

19-09-202619-10-2026

EPSS score

12.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (coresecurity.com)
Maturity: unknown
exploit-databaseremotemultipleUnverified
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
Maturity: poc

References

4 links

www.exploit-db.com/exploits/43388/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/102275VDB EntryX Refsource BIDThird Party Advisory
success.trendmicro.com/solution/1118992X Refsource CONFIRMVendor Advisory
www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilitiesX Refsource MISCExploitThird Party Advisory

Related vulnerabilities

CVE-2018-10350trend microtrend micro smart protection server (standalone)+114.17%8y ago25-05-2018 15:00A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw within the handling of parameters provided to wcs\_bwlists\_handler.php. Authentication is required in order to exploit this vulnerability.CVE-2018-6237trend microtrend micro smart protection server (standalone)+16.28%8y ago25-05-2018 15:00A vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow an unauthenticated remote attacker to manipulate the product to send a large number of specially crafted HTTP requests to potentially cause the file system to fill up, eventually causing a denial of service (DoS) situation.CVE-2018-6231trend microtrend micro smart protection server (standalone)+16.95%8y ago15-03-2018 19:00A server auth command injection authentication bypass vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.3 and below could allow remote attackers to escalate privileges on vulnerable installations.CVE-2016-6266trendmicrosmart_protection_server8.15%9y ago30-01-2017 22:00ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) host or (2) apikey parameter in a register action, (3) enable parameter in a save_stting action, or (4) host or (5) apikey parameter in a test_connection action.CVE-2016-6269trendmicrosmart_protection_server3.72%9y ago30-01-2017 22:00Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allow remote attackers to read and delete arbitrary files via the tmpfname parameter to (1) log_mgt_adhocquery_ajaxhandler.php, (2) log_mgt_ajaxhandler.php, (3) log_mgt_ajaxhandler.php or (4) tf parameter to wcs_bwlists_handler.php.CVE-2016-6267trendmicrosmart_protection_server54.87%9y ago30-01-2017 22:00SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3) spare_AllowGroupNetmask parameter to admin_notification.php.

All vulnerabilities intrend micro smart protection server (standalone)smart_protection_server

CVE-2017-14095: trend micro trend micro smart protection server (standalone) PHP Remote File Inclusion

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References