CVE-2017-14084

HIGH

Trend Micro OfficeScan 11.0 and XG (12.0) - Remote Code Execution via Man-in-the-Middle Attack

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-14084. PoCs published by hyp3rlinx.

AI-analyzed exploit summary This is a vulnerability writeup for CVE-2017-14084, detailing a Man-in-the-Middle (MITM) Remote Code Execution flaw in TrendMicro OfficeScan due to insecure cURL SSL settings. The advisory explains how the vulnerability arises from disabling SSL certificate verification in the Send() function of HttpTalk.php.

Description

A potential Man-in-the-Middle (MitM) attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to execute arbitrary code on vulnerable installations.

Exploits (1)

exploitdb WRITEUP VERIFIED

by hyp3rlinx · textremotewindows

https://www.exploit-db.com/exploits/42891

View Code ZIP pw:eip

This is a vulnerability writeup for CVE-2017-14084, detailing a Man-in-the-Middle (MITM) Remote Code Execution flaw in TrendMicro OfficeScan due to insecure cURL SSL settings. The advisory explains how the vulnerability arises from disabling SSL certificate verification in the Send() function of HttpTalk.php.

Classification

Writeup 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Theoretical

Target: TrendMicro OfficeScan v11.0 and XG (12.0)

No auth needed

Prerequisites: Man-in-the-Middle position · Ability to intercept and modify network traffic

MITRE ATT&CK