CVE-2020-8605

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro InterScan Web Security Virtual Appliance	6.5

References

http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/000253095Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-676/Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/158171/Trend-Micro-Web-Security-Virtual-Appliance-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/158423/Trend-Micro-Web-Security-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/000253095Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-676/Third Party Advisory, VDB Entry

Timeline

Published: May 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-86069.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected CVE-2020-86076.7An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection dri CVE-2020-86085.6In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.CVE-2020-86118.8In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the CVE-2020-86129.0In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious i CVE-2020-86149.8An issue was discovered on Askey AP4000W TDC_V1.01.003 devices. An attacker can perform Remote Code Execution (RCE) by sending a specially c CVE-2020-86156.5A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and CVE-2020-86168.6A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals CVE-2020-86175.9Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or CVE-2020-86184.9An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure CVE-2020-86194.9In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9 CVE-2020-86207.5In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection