CVE-2020-28580: Command Injection

Published Nov 18, 2020

Updated

A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.

Affected Software

1 affected component

trendmicro Interscan Web Security Virtual Appliance=6.5-sp2

Event History

Nov 18, 2020

CVE Published

via MITRE·06:45 PM

Data Sourced

via MITRE·06:45 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-28580?

CVE-2020-28580 is a command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2.

How does CVE-2020-28580 affect Trend Micro InterScan Web Security Virtual Appliance?

CVE-2020-28580 allows an authenticated, remote attacker to execute arbitrary OS commands with elevated privileges.

What is the severity of CVE-2020-28580?

CVE-2020-28580 has a severity rating of 7.2 (Critical).

How can I fix CVE-2020-28580?

To fix CVE-2020-28580, users should update to Trend Micro InterScan Web Security Virtual Appliance 6.5 SP3 or later.

Where can I find more information about CVE-2020-28580?

More information about CVE-2020-28580 can be found at the following references: [link1], [link2].