CVE-2007-2508: Trend Micro ServerProtect stack buffer overflow via RPC ports

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 10.0 with no authentication or user interaction, remote code execution, and a high EPSS score make this an urgent patch-and-isolate case.

What it is

Trend Micro ServerProtect 5.58 before Security Patch 2 Build 1174 contains multiple stack-based buffer overflows reachable through TmRpcSrv.dll. Crafted data sent to TCP port 5168 overflows CAgRpcClient::CreateBinding in AgRpcCln.dll within SpntSvc.exe, and crafted data to TCP port 3628 overflows EarthAgent.exe. Both flaws allow remote code execution on the affected server.

Impact

A remote attacker can execute arbitrary code with the privileges of the affected service, typically SYSTEM on the ServerProtect host. This gives full control of the server, including the ability to disable protection or pivot into the managed network.

Attack surface

The flaws are reached over the network via TCP ports 5168 and 3628; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host that can reach those ports on a vulnerable ServerProtect installation can trigger the overflow.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.77194 (99.5th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists. No ransomware group is documented as using it.

What to do

• Apply Trend Micro ServerProtect Security Patch 2 Build 1174 or later immediately.
• Block inbound TCP 5168 and 3628 from untrusted networks at the host and network firewall.
• Restrict ServerProtect management and agent traffic to trusted management subnets only.
• If patching cannot be done at once, isolate affected servers or disable the vulnerable services until the patch is applied.
• Monitor vendor advisories for any follow-up patches or updated guidance.

Detection

• Alert on network connections to TCP 5168 or 3628 from hosts outside the expected management subnet.
• Inspect ServerProtect and EarthAgent process logs for crashes or abnormal termination around RPC activity.
• Use IDS/IPS signatures for oversized or malformed RPC payloads targeting these ports.
• Hunt for unexpected child processes or command shells spawned by SpntSvc.exe or EarthAgent.exe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.