CVE-2016-7552: Trend Micro Threat Discovery Appliance path traversal in session_id cookie

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, root-level file deletion, and public exploit code make this a critical risk.

What it is

The Trend Micro Threat Discovery Appliance 2.6.1062r1 processes the session_id cookie without sanitizing path traversal sequences, allowing a remote, unauthenticated attacker to delete arbitrary files as root. Because deletion runs with root privileges, the flaw can be used to bypass authentication or cause a denial of service.

Impact

An attacker can delete arbitrary files as root on the appliance, which can remove authentication-related files to bypass login or destroy system files to cause a denial of service.

Attack surface

Reachable over the network via a crafted session_id cookie; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.93249, 99.8th percentile) and references include an Exploit-tagged Metasploit commit, indicating public exploit code exists.

What to do

• Apply the vendor patch or fixed firmware for Threat Discovery Appliance 2.6.1062r1 if available.
• If no patch exists, isolate the appliance from untrusted networks and restrict management access to trusted hosts.
• Validate and reject session_id cookie values containing path traversal sequences at any proxy or WAF in front of the appliance.
• Back up the appliance configuration and monitor for unexpected file deletions or authentication failures.
• Retire or replace the appliance if it is end-of-support and cannot be patched.

Detection

• Monitor appliance and web logs for session_id cookie values containing ../ or encoded traversal sequences.
• Alert on unexpected deletion or disappearance of system or authentication files on the appliance.
• Watch for authentication bypass attempts or repeated login failures against the appliance.
• Use file integrity monitoring on the appliance filesystem to detect unauthorized deletions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.