CVE-2017-11394

9.8 criticalEPSS 67%

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 67% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2017-08-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

trendmicro:officescan

References

http://www.securityfocus.com/bid/100130
http://www.zerodayinitiative.com/advisories/ZDI-17-521
https://success.trendmicro.com/solution/1117769
https://www.exploit-db.com/exploits/42971/
http://www.securityfocus.com/bid/100130

Check your stack JSON