CVE-2017-14089

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated users who can access the OfficeScan server to target cgiShowClientAdm.exe and cause memory corruption issues.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro OfficeScan	11.0, XG (12.0)

References

http://hyp3rlinx.altervista.org/advisories/CVE-2017-14089-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-REMOTE-MEMORY-CORRUPTION.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/144464/TrendMicro-OfficeScan-11.0-XG-12.0-Memory-Corruption.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/Sep/91Mailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/541271/100/0/threaded
http://www.securityfocus.com/bid/101076Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039500Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/1118372Patch, Vendor Advisory
https://www.exploit-db.com/exploits/42920/Exploit, Third Party Advisory, VDB Entry
http://hyp3rlinx.altervista.org/advisories/CVE-2017-14089-TRENDMICRO-OFFICESCAN-XG-PRE-AUTH-REMOTE-MEMORY-CORRUPTION.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/144464/TrendMicro-OfficeScan-11.0-XG-12.0-Memory-Corruption.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/Sep/91Mailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/541271/100/0/threaded
http://www.securityfocus.com/bid/101076Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039500Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/1118372Patch, Vendor Advisory
https://www.exploit-db.com/exploits/42920/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Oct 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-14095.3IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The informatio CVE-2017-140909.1A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted.CVE-2017-140917.5A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - O CVE-2017-140928.8The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticate CVE-2017-140936.1The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks.CVE-2017-140949.8A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command CVE-2017-140958.1A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command CVE-2017-140966.1A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an CVE-2017-140979.8An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker CVE-2017-140987.5In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, o CVE-2017-140997.5In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11 CVE-2017-141009.8In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before