← Vulnerability feed

Vulnerability record · CVE-2018-6220 · published 15 March 2018

CVE-2018-6220: Trendmicro email encryption gateway injection vulnerability

Trendmicro · Email Encryption Gateway

An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining code execution on vulnerable systems.

9.8 CVSS 3.0 Critical EPSS 9.9% · top 4.6% CWE-74 · Injection
9.8CVSS 3.0 base score, v2 7.5
9.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining code execution on vulnerable systems.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://success.trendmicro.com/solution/1119349 PatchVendor Advisory
https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory
https://www.exploit-db.com/exploits/44166/ ExploitThird Party AdvisoryVDB Entry
https://success.trendmicro.com/solution/1119349 PatchVendor Advisory
https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory
https://www.exploit-db.com/exploits/44166/ ExploitThird Party AdvisoryVDB Entry

Track CVE-2018-6220 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-6228Trendmicro email encryption gateway sql injection vulnerabilityA SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to upload a…EPSS 10%9.8CVE-2018-6229Trendmicro email encryption gateway sql injection vulnerabilityA SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to up…EPSS 10%9.8CVE-2018-6223Trendmicro email encryption gateway missing authentication for critical function vulnerabilityA missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate t…EPSS 10%9.8CVE-2016-4351Trendmicro email encryption gateway sql injection vulnerabilitySQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote a…EPSS 2.8%8.8CVE-2018-10351Trendmicro email encryption gateway sql injection vulnerabilityA vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installat…EPSS 3.6%8.8CVE-2018-10352Trendmicro email encryption gateway sql injection vulnerabilityA vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installat…EPSS 2.1%8.8CVE-2018-10354Trendmicro email encryption gateway os command injection vulnerabilityA command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbit…EPSS 13%8.8CVE-2018-10356Trendmicro email encryption gateway sql injection vulnerabilityA SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL stat…EPSS 10%

Source: NIST National Vulnerability Database (record CVE-2018-6220), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.