CVE-2024-36473

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to local Denial of Service (DoS) and under specific conditions can lead to elevation of privileges.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-73

Affected software

Vendor	Product	Versions
Trend Micro, Inc.	Trend Micro VPN Proxy One Pro	>= 5.8, < 5.8.1012

References

https://helpcenter.trendmicro.com/en-us/article/tmka-07247Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-585/Third Party Advisory
https://helpcenter.trendmicro.com/en-us/article/tmka-07247Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-585/Third Party Advisory

Timeline

Published: Jun 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-364747.8An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (CVE-2024-364758.8FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user CVE-2024-364765.5In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of CVE-2024-364777.8In the Linux kernel, the following vulnerability has been resolved: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer CVE-2024-364785.5In the Linux kernel, the following vulnerability has been resolved: null_blk: fix null-ptr-dereference while configuring 'power' and 'submi CVE-2024-364795.5In the Linux kernel, the following vulnerability has been resolved: fpga: bridge: add owner module and take its refcount The current imple CVE-2024-36485.4The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' sho CVE-2024-364809.8Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an at CVE-2024-364815.5In the Linux kernel, the following vulnerability has been resolved: tracing/probes: fix error check in parse_btf_field() btf_find_struct_m CVE-2024-364826.7Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalatio CVE-2024-364845.5In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time. Christoph reported the f CVE-2024-364858.8Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to SQL Injection in Technician reports option.