CVE-2022-25329

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An unauthenticated remote attacker with access to the Information Server could exploit this to register to the server and perform authenticated actions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro ServerProtect for Storage	6.0
Trend Micro	Trend Micro ServerProtect for Microsoft Windows / Novell NetWare	5.8
Trend Micro	Trend Micro ServerProtect for EMC Celerra	5.8
Trend Micro	Trend Micro ServerProtect for Network Appliance Filers	5.8

References

https://success.trendmicro.com/solution/000290507Patch, Vendor Advisory
https://www.tenable.com/security/research/tra-2022-05Third Party Advisory
https://success.trendmicro.com/solution/000290507Patch, Vendor Advisory
https://www.tenable.com/security/research/tra-2022-05Third Party Advisory

Timeline

Published: Feb 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-25337.4An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2 CVE-2022-253309.8Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the pr CVE-2022-253317.5Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remote attacker to crash CVE-2022-253324.1The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which c CVE-2022-253338.8The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loa CVE-2022-253348.8The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) lacks a bounds check on the signature size field in th CVE-2022-253357.5RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in CVE-2022-253365.3Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks agai CVE-2022-253379.8Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.CVE-2022-253386.8ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers.CVE-2022-253395.5ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers.CVE-2022-25345.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before