CVE-2017-6398: Trend Micro InterScan Messaging Security command injection in saveCert.imss

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityNetwork-reachable authenticated command injection yielding root, with default credentials and a public Metasploit module, makes this a high-priority target despite no KEV listing.

What it is

Trend Micro InterScan Messaging Security Virtual Appliance 9.1-1600 contains an OS command injection flaw in the saveCert.imss endpoint. The endpoint passes user-supplied input to an operating-system command after an improper blacklist check, allowing an authenticated user to run commands as the web server user, which is root. The default installation also ships with default administrator credentials, lowering the bar for reaching the vulnerable endpoint.

Impact

An attacker who can authenticate gains arbitrary command execution as root on the appliance, leading to full compromise of confidentiality, integrity and availability. Because the web server user is root, there is no privilege boundary left to contain the attacker.

Attack surface

The flaw is reached over the network through the saveCert.imss endpoint of the web interface, per the CVSS vector AV:N/AC:L/PR:L/UI:N. Authentication is required, but the default administrator credentials shipped with the product make that requirement weak in practice.

Exploitation

The record is not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.54068 (99th percentile) and a public Rapid7 Metasploit module exists, indicating mature, widely available exploit tooling.

What to do

• Apply the vendor patch for InterScan Messaging Security Virtual Appliance 9.1-1600 as soon as it is available.
• Change the default administrator credentials immediately and enforce strong, unique passwords on the appliance.
• Restrict network access to the IMSVA management interface to trusted administrative networks only.
• Run the web service under a non-root account so command injection does not yield root privileges.
• Monitor and audit the saveCert.imss endpoint for unexpected command arguments or process execution.

Detection

• Inspect web server and application logs for requests to saveCert.imss containing shell metacharacters or unexpected command strings.
• Alert on child processes spawned by the IMSVA web server user, especially shell interpreters or system utilities.
• Monitor for authentication using default administrator credentials followed by configuration or certificate operations.
• Use file integrity monitoring on the appliance to detect changes made by unexpected root-level processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.