CVE-2018-3602

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An AdHocQuery_Processor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary code on vulnerable installations.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Control Manager	6.0

References

https://success.trendmicro.com/solution/1119158Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-18-068/Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/1119158Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-18-068/Third Party Advisory, VDB Entry

Timeline

Published: Feb 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-36038.8A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to ex CVE-2018-36048.8GetXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to CVE-2018-36058.8TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 co CVE-2018-36068.8XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Cont CVE-2018-36078.8XXXTreeNode method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacke CVE-2018-36089.8A vulnerability in Trend Micro Maximum Security's (Consumer) 2018 (versions 12.0.1191 and below) User-Mode Hooking (UMH) driver could allow CVE-2018-36098.1A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticat CVE-2018-36106.0SEMA driver in Intel Driver and Support Assistant before version 3.1.1 allows a local attacker the ability to read and writing to Memory Sta CVE-2018-36116.5Bounds check vulnerability in User Mode Driver in Intel Graphics Driver 15.40.x.4 and 21.20.x.x allows unprivileged user to cause a denial o CVE-2018-36127.8Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Ma CVE-2018-36137.8Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation o CVE-2018-36157.3Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosu