PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9314 Trendmicro CVE debrief

CVE-2016-9314 is a sensitive information disclosure issue in Trend Micro InterScan Web Security Virtual Appliance (IWSVA). According to the NVD record and Trend Micro’s advisory, an authenticated remote user with least privileges could use the ConfigBackup servlet to back up the system configuration and download it locally, exposing sensitive data such as passwd/shadow files, RSA certificates, private keys, and the default passphrase. Trend Micro states the issue was resolved in 6.5 CP 1737.

Vendor
Trendmicro
Product
Interscan Web Security Virtual Appliance
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-21
Original CVE updated
2026-05-13
Advisory published
2017-02-21
Advisory updated
2026-05-13

Who should care

Security and operations teams running Trend Micro IWSVA, especially environments that allow multiple authenticated administrators or delegated low-privilege accounts. Anyone responsible for appliance backups, secret management, or credential rotation should treat this as a high-priority issue.

Technical summary

NVD classifies the flaw as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) with CVSS 3.0 7.8. The vulnerable component is com.trend.iwss.gui.servlet.ConfigBackup in IWSVA 6.5-SP2_Build_Linux_1707 and earlier. A least-privilege authenticated remote user could trigger a configuration backup and retrieve a file containing highly sensitive authentication material and cryptographic secrets. The vendor indicates the issue is fixed in Version 6.5 CP 1737.

Defensive priority

High

Recommended defensive actions

  • Upgrade Trend Micro IWSVA to Version 6.5 CP 1737 or later.
  • Review appliance roles and restrict low-privilege authenticated access to backup-related functions.
  • Audit whether any configuration backups were downloaded from affected systems before remediation.
  • Rotate any credentials, private keys, certificates, and default passphrases that may have been exposed.
  • Verify that backup artifacts are stored and transmitted only through approved administrative channels.
  • Check vendor guidance in the Trend Micro advisory for product-specific remediation steps.

Evidence notes

This debrief is based on the NVD CVE record, which lists the vulnerable product scope, CWE-200 classification, and CVSS vector, and on the Trend Micro vendor advisory referenced by the CVE record. The CVE description explicitly states that authenticated remote users with least privileges could back up the system configuration and download sensitive files, and that the issue was resolved in 6.5 CP 1737. No KEV entry is present in the provided data.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9314 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9314

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9314 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9314

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.