CVE-2017-14086
high-risk
Published 2017-10-06
Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to start the fcgiOfcDDA.exe executable or cause a potential INI corruption, which may cause the server disk space to be consumed with dump files from continuous HTTP requests.
Do I need to act?
!
14.2% chance of exploitation in next 30 days
EPSS score — higher than 86% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
NETWORK
/ LOW complexity
Affected Products (2)
Affected Vendors
References (16)
Third Party Advisory
http://packetstormsecurity.com/files/144401/TrendMicro-OfficeScan-11.0-XG-12.0-A...
Mailing List
http://seclists.org/fulldisclosure/2017/Sep/88
Third Party Advisory
http://www.securityfocus.com/bid/101076
Third Party Advisory
http://www.securitytracker.com/id/1039500
Third Party Advisory
https://www.exploit-db.com/exploits/42892/
Third Party Advisory
http://packetstormsecurity.com/files/144401/TrendMicro-OfficeScan-11.0-XG-12.0-A...
Mailing List
http://seclists.org/fulldisclosure/2017/Sep/88
Third Party Advisory
http://www.securityfocus.com/bid/101076
Third Party Advisory
http://www.securitytracker.com/id/1039500
Third Party Advisory
https://www.exploit-db.com/exploits/42892/
52
/ 100
high-risk
Severity
26/34 · High
Exploitability
19/34 · Moderate
Exposure
7/34 · Low