CVE-2020-8606

CRITICAL

Trend Micro InterScan Web Security Virtual Appliance 6.5 - Auth Bypass

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-8606. PoCs published by Mehmet Ince <[email protected]>, including Metasploit module exploits/linux/http/trendmicro_websecurity_exec.

AI-analyzed exploit summary This Metasploit module exploits a chain of vulnerabilities (CVE-2020-8604, CVE-2020-8605, CVE-2020-8606) in Trend Micro Web Security to achieve unauthenticated remote code execution as root. It hijacks a session ID via a proxy service flaw, then injects a Python payload through a command injection vulnerability.

Description

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.

Exploits (1)

metasploit WORKING POC EXCELLENT

by Mehmet Ince <[email protected]> · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trendmicro_websecurity_exec.rb

View Code ZIP pw:eip

This Metasploit module exploits a chain of vulnerabilities (CVE-2020-8604, CVE-2020-8605, CVE-2020-8606) in Trend Micro Web Security to achieve unauthenticated remote code execution as root. It hijacks a session ID via a proxy service flaw, then injects a Python payload through a command injection vulnerability.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Complex

Reliability

Reliable

Target: Trend Micro Web Security (Virtual Appliance) < 6.5 SP2 Patch 4 (Build 1901)

No auth needed

Prerequisites: Network access to ports 8443 and 8080 · Python payload compatibility

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry x_refsource_misc

https://www.zerodayinitiative.com/advisories/ZDI-20-677/

Patch, Vendor Advisory x_refsource_misc

https://success.trendmicro.com/solution/000253095

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.html

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.html

Scores

CVSS v3 9.8

EPSS 0.7274

EPSS Percentile 99.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287

Status published

Products (1)

trendmicro/interscan_web_security_virtual_appliance 6.5

Published May 27, 2020

Tracked Since Feb 18, 2026