CVE-2016-6267: Trend Micro Smart Protection Server command injection in SnmpUtils

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote authenticated command execution with high EPSS and a public exploit writeup, though it requires valid credentials and is not in KEV.

What it is

SnmpUtils in Trend Micro Smart Protection Server 2.5, 2.6 and 3.0 fails to validate the spare_Community, spare_AllowGroupIP and spare_AllowGroupNetmask parameters passed to admin_notification.php, allowing shell metacharacters to reach a command shell. An authenticated remote user can therefore run arbitrary commands on the server, which is a serious risk for a security management appliance.

Impact

An attacker with a valid account gains arbitrary command execution on the Smart Protection Server, giving full control of confidentiality, integrity and availability of that host and any data or credentials it holds.

Attack surface

Reached over the network through the admin_notification.php endpoint of the web interface; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

No CISA KEV listing, but EPSS is 0.54872 (99th percentile) and public references include an Exploit-tagged third-party technical writeup, so exploitation is plausible and tooling or guidance is publicly available.

What to do

• Apply the vendor patch by upgrading to Smart Protection Server 2.5 build 2200, 2.6 build 2106 or 3.0 build 1330 or later.
• Restrict network access to the Smart Protection Server admin interface to trusted management networks.
• Audit and reduce accounts with access to the admin interface, and remove unused or default accounts.
• Validate and sanitize the spare_Community, spare_AllowGroupIP and spare_AllowGroupNetmask inputs if any custom code touches them.
• Monitor the server for unexpected child processes or outbound connections from the web service.

Detection

• Review web server and application logs for requests to admin_notification.php with shell metacharacters in spare_Community, spare_AllowGroupIP or spare_AllowGroupNetmask.
• Alert on unexpected processes spawned by the web server user, especially shells or command interpreters.
• Monitor for outbound connections or file changes on the Smart Protection Server host that do not match normal management activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.