CVEvulnerability

CVE-2022-25329

9.8 CRITICAL Published 2022-02-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-02-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-798

Description

Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An unauthenticated remote attacker with access to the Information Server could exploit this to register to the server and perform authenticated actions.

Affected configurations

• trendmicro serverprotect 5.8 • trendmicro serverprotect for network appliance filer 5.8 • trendmicro serverprotect for storage 6.0

Related

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References