CVE-2020-28581

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro InterScan Web Security Virtual Appliance	6.5 SP2

References

https://success.trendmicro.com/solution/000281954Vendor Advisory
https://www.tenable.com/security/research/tra-2020-63Exploit, Third Party Advisory
https://success.trendmicro.com/solution/000281954Vendor Advisory
https://www.tenable.com/security/research/tra-2020-63Exploit, Third Party Advisory

Timeline

Published: Nov 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-285825.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285835.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285877.8A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an o CVE-2020-285885.5An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifical CVE-2020-285898.8An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development CVE-2020-28597.5Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: nVision). Supported versions that are affect CVE-2020-285906.5An out-of-bounds read vulnerability exists in the Obj File TriangleMesh::TriangleMesh() functionality of Slic3r libslic3r 1.3.0 and Master C CVE-2020-285916.5An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and Master CVE-2020-285929.8A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AF CVE-2020-285938.1A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially CVE-2020-285947.8A use-after-free vulnerability exists in the _3MF_Importer::_handle_end_model() functionality of Prusa Research PrusaSlicer 2.2.0 and Master CVE-2020-285957.8An out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4