← Vulnerability feed

Vulnerability record · CVE-2018-6221 · published 15 March 2018

CVE-2018-6221: Trendmicro email encryption gateway improper certificate validation vulnerability

Trendmicro · Email Encryption Gateway

An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file and inject their own.

8.1 CVSS 3.0 High EPSS 6.1% · top 6.8% CWE-295 · Improper certificate validation
8.1CVSS 3.0 base score, v2 9.3
6.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file and inject their own.

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://success.trendmicro.com/solution/1119349 PatchVendor Advisory
https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory
https://www.exploit-db.com/exploits/44166/ ExploitThird Party AdvisoryVDB Entry
https://success.trendmicro.com/solution/1119349 PatchVendor Advisory
https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities ExploitTechnical DescriptionThird Party Advisory
https://www.exploit-db.com/exploits/44166/ ExploitThird Party AdvisoryVDB Entry

Track CVE-2018-6221 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-6228Trendmicro email encryption gateway sql injection vulnerabilityA SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to upload a…EPSS 10%9.8CVE-2018-6229Trendmicro email encryption gateway sql injection vulnerabilityA SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to up…EPSS 10%9.8CVE-2018-6220Trendmicro email encryption gateway injection vulnerabilityAn arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to…EPSS 9.9%9.8CVE-2018-6223Trendmicro email encryption gateway missing authentication for critical function vulnerabilityA missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate t…EPSS 10%9.8CVE-2016-4351Trendmicro email encryption gateway sql injection vulnerabilitySQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote a…EPSS 2.8%8.8CVE-2018-10351Trendmicro email encryption gateway sql injection vulnerabilityA vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installat…EPSS 3.6%8.8CVE-2018-10352Trendmicro email encryption gateway sql injection vulnerabilityA vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installat…EPSS 2.1%8.8CVE-2018-10354Trendmicro email encryption gateway os command injection vulnerabilityA command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbit…EPSS 13%

Source: NIST National Vulnerability Database (record CVE-2018-6221), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.