CVE-2016-7547: Trend Micro Threat Discovery Appliance timezone parameter command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS score of 9.8, unauthenticated remote command execution, and very high EPSS probability make this an urgent risk.

What it is

The admin_sys_time.cgi interface in Trend Micro Threat Discovery Appliance 2.6.1062r1 fails to properly handle the timezone parameter, allowing command injection. A remote, unauthenticated attacker can execute arbitrary commands on the appliance, which is a critical network security device.

Impact

An attacker can execute arbitrary operating system commands with the privileges of the web service, leading to full compromise of the appliance. This could allow data exfiltration, lateral movement into the network, or denial of service.

Attack surface

The flaw is reachable over the network via the admin_sys_time.cgi endpoint, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

The record includes an exploit reference (Metasploit pull request) and EPSS probability of 0.92721 (99.8th percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV.

What to do

• Apply the vendor patch for Trend Micro Threat Discovery Appliance 2.6.1062r1 or later as soon as possible.
• Restrict network access to the appliance's management interface to trusted IP addresses only.
• Disable or block access to admin_sys_time.cgi if not required.
• Monitor for suspicious command execution or outbound connections from the appliance.
• Consider replacing end-of-life appliances that no longer receive security updates.

Detection

• Inspect HTTP requests to admin_sys_time.cgi for unusual characters or command separators in the timezone parameter.
• Monitor process creation on the appliance for unexpected commands spawned by the web server.
• Review network logs for outbound connections from the appliance to unknown external hosts.
• Use the Metasploit module reference to create IDS/IPS signatures for known exploit patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.