CVE-2019-9491

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Anti-Threat Toolkit (ATTK)	Version 1.62.0.1218 and below

References

http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-ANTI-THREAT-TOOLKIT-%28ATTK%29-REMOTE-CODE-EXECUTION.txt
http://packetstormsecurity.com/files/156160/TrendMicro-Anti-Threat-Toolkit-Improper-Fix.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Oct/42Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/50Exploit, Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Oct/30Exploit, Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/55Exploit, Mailing List, Third Party Advisory
https://success.trendmicro.com/solution/000149878Vendor Advisory
http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-ANTI-THREAT-TOOLKIT-%28ATTK%29-REMOTE-CODE-EXECUTION.txt
http://packetstormsecurity.com/files/156160/TrendMicro-Anti-Threat-Toolkit-Improper-Fix.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Oct/42Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2020/Jan/50Exploit, Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2019/Oct/30Exploit, Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/55Exploit, Mailing List, Third Party Advisory
https://success.trendmicro.com/solution/000149878Vendor Advisory

Timeline

Published: Oct 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-94927.8A DLL side-loading vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow an authenticated attacker to gain code execution and CVE-2019-94939.8The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated att CVE-2019-94945.9The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences CVE-2019-94953.7The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. Al CVE-2019-94967.5An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the CVE-2019-94978.1The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Co CVE-2019-94988.1The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, CVE-2019-94998.1The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported eleme CVE-2019-95008.3The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the W CVE-2019-95018.8The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger tha CVE-2019-95028.8The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes,CVE-2019-95038.3The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If th