PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6267 Trendmicro CVE debrief

CVE-2016-6267 describes an authenticated command injection issue in Trend Micro Smart Protection Server’s SnmpUtils handling for admin_notification.php. If an attacker can authenticate to the product, shell metacharacters in specific parameters may be used to execute arbitrary commands on affected systems.

Vendor
Trendmicro
Product
Smart Protection Server
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Organizations running Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, or 3.0 before build 1330 should treat this as important. Security teams responsible for web-administered appliance/software platforms should also prioritize it because the impact is full remote command execution once authentication is obtained.

Technical summary

The vulnerability is described as a shell metacharacter injection flaw in SnmpUtils within admin_notification.php. The affected parameters are spare_Community, spare_AllowGroupIP, and spare_AllowGroupNetmask. NVD lists the weakness under CWE-20 and rates the issue CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network reachability, low attack complexity, and high confidentiality, integrity, and availability impact.

Defensive priority

High. The issue is network-reachable and can lead to arbitrary command execution by a remote authenticated user, so exposed or actively administered Smart Protection Server deployments should be patched quickly.

Recommended defensive actions

  • Upgrade Trend Micro Smart Protection Server to a fixed build: 2.5 build 2200 or later, 2.6 build 2106 or later, or 3.0 build 1330 or later.
  • Review and restrict administrative access to Smart Protection Server accounts, since the attack requires authentication.
  • Validate that any systems matching the affected product versions are inventoried and scheduled for remediation.
  • Check vendor guidance in the Trend Micro advisory for product-specific mitigation steps and patch availability.
  • Inspect administrative and application logs for unexpected use of admin_notification.php or unusual parameter values.

Evidence notes

All material facts in this debrief are taken from the supplied NVD record and the linked Trend Micro and third-party references. The CVE description states that authenticated remote users can execute arbitrary commands via shell metacharacters in spare_Community, spare_AllowGroupIP, or spare_AllowGroupNetmask in admin_notification.php. NVD lists affected Smart Protection Server versions/builds and a CVSS 3.1 score of 8.8 with CWE-20.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6267 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6267

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6267 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6267

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.