CVE-2017-11393

9.8 criticalEPSS 16%

Critical (9.8) in trendmicro officescan. EPSS 16% chance of exploitation in the next 30 days.

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 16% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2017-08-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

trendmicro:officescan

References

http://www.securityfocus.com/bid/100127
http://www.zerodayinitiative.com/advisories/ZDI-17-522
https://success.trendmicro.com/solution/1117769
http://www.securityfocus.com/bid/100127
http://www.zerodayinitiative.com/advisories/ZDI-17-522

Check your stack JSON