8.8

CVE-2024-51503

A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine.  In certain circumstances, attackers that have legitimate access to the domain may be able to remotely inject commands to other machines in the same domain.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability locally and must have domain user privileges to affect other machines.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Trendmicro ≫ Deep Security Agent Version 20.0 Update - SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1337 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1559 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update158 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update167 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1681 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update173 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update180 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update182 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1822 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update183 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1876 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update190 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update198 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2009 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update208 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update213 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2204 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update223 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update224 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2395 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2419 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2593 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2740 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2921 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3165 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3288 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3445 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3530 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3771 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3964 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update4185 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update4416 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update4726 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update4959 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5137 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5394 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5512 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5761 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5810 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5995 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update6313 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update6690 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update6860 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update690 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7119 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7303 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7476 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7719 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7943 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update8137 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update8268 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update8438 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update877 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 Update update12510 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 Update update14610 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 Update update17380 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 Update update19250 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 Update update3180 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 Update update4540 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 Update update690 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 Update update7380 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0.1 Update update9400 SwEdition long_term_support
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.03% 0.893
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Trendmicro 8 1.3 6
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://success.trendmicro.com/en-US/solution/KA-0018154
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-1516/
Third Party Advisory