PT-2017-11966 · Trend Micro · Trend Micro Deep Discovery Inspector

Published 2017-08-01 · Updated 2017-08-07 · CVE-2017-11380

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Deep Discovery Director version 1.1

Description The issue concerns the use of a static password for encrypting backup archives across different installations of the software. This suggests that the same password may be used in all virtual appliance instances, potentially affecting multiple devices.

Recommendations For Trend Micro Deep Discovery Director version 1.1, consider changing the static password used for backup archive encryption to a unique password for each installation to minimize the risk of unauthorized access.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-11380

Affected Products

Trend Micro Deep Discovery Inspector

References · 4

• https://success.trendmicro.com/solution/1117663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11380 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11380 · Vendor Advisory
• https://coresecurity.com/advisories/trend-micro-deep-discovery-director-multiple-vulnerabilities · Note