PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6270 Trendmicro CVE debrief

CVE-2016-6270 is a high-severity authenticated command-injection issue in Trend Micro Virtual Mobile Infrastructure (VMI) before 5.1. According to the CVE description, the handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py can be abused through shell metacharacters in the password supplied to api/v1/cfg/oauth/save_identify_pfx/, enabling arbitrary command execution by a remote authenticated user.

Vendor
Trendmicro
Product
Virtual Mobile Infrastructure
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for Trend Micro Virtual Mobile Infrastructure, especially systems exposing the affected API or management functions, should treat this as a priority. Identity, API, and platform owners should also review access controls and patch status.

Technical summary

The issue is a shell-command injection problem (CWE-77) in VMI's handle_certificate workflow. NVD maps the affected product as Trend Micro Virtual Mobile Infrastructure 5.0 and assigns CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8). The published description states that a remote authenticated user can achieve arbitrary command execution by supplying shell metacharacters in the password parameter used by api/v1/cfg/oauth/save_identify_pfx/.

Defensive priority

High. The vulnerability is remotely reachable, requires only low privileges, and can result in full confidentiality, integrity, and availability impact on the affected appliance or service.

Recommended defensive actions

  • Upgrade Trend Micro Virtual Mobile Infrastructure to version 5.1 or later, consistent with the published affected-version boundary.
  • Restrict access to the affected management/API interface to trusted administrative networks only.
  • Review authentication and authorization controls around the certificate import and OAuth configuration workflow.
  • Search logs and audit trails for unusual requests to api/v1/cfg/oauth/save_identify_pfx/ and related management commands.
  • Rotate credentials and certificates if there is any indication the affected function was misused.
  • Validate and sanitize all user-controlled inputs that reach shell execution paths, and remove shell invocation where possible.

Evidence notes

The CVE description explicitly names the vulnerable function, file path, endpoint, and the shell-metacharacter condition. NVD lists the weakness as CWE-77 and provides a high-severity CVSS 3.1 vector. The supplied NVD metadata also marks Trend Micro Virtual Mobile Infrastructure 5.0 as vulnerable, while the description states the issue affects versions before 5.1. References include the vendor advisory and a technical third-party write-up, but no KEV entry was supplied in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6270 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6270

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6270 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6270

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.