Trend Micro Deep Discovery Director vulnerabilities

3 CVEs affecting Trend Micro Deep Discovery Director, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-11381, published 2017-08-01.

More from Trend Micro.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-11381, published 2017-08-01. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console.
• CVE-2017-11380, published 2017-08-01. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep…
• CVE-2017-11379, published 2017-08-01. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1.