CVE-2020-28578: Trend Micro InterScan Web Security Virtual Appliance out-of-bounds write RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and high EPSS plus an exploit-tagged reference make this a top remediation priority.

What it is

Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 contains an out-of-bounds write (CWE-787) reachable through a specially crafted HTTP message. A remote, unauthenticated attacker can trigger it to run code with elevated privileges, making it a critical pre-auth flaw in an internet-facing security appliance.

Impact

Successful exploitation gives the attacker remote code execution with elevated privileges on the appliance, allowing full compromise of the device and any traffic or credentials it inspects.

Attack surface

Reached over the network via HTTP; the CVSS vector shows no privileges required and no user interaction, so the crafted request can be sent directly to the exposed service.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.73048, 99.4th percentile) and a third-party advisory is tagged Exploit, indicating public exploit detail exists.

What to do

• Apply the vendor fix from Trend Micro solution 000281954 for InterScan Web Security Virtual Appliance 6.5 SP2.
• Restrict management and web interfaces from untrusted networks; place the appliance behind filtering or a VPN where feasible.
• Monitor the vendor advisory for updated builds and confirm the installed version is patched.
• If patching is delayed, isolate the appliance and limit inbound HTTP to trusted sources only.

Detection

• Inspect HTTP request logs and IDS/IPS alerts for malformed or oversized requests targeting the appliance's web interface.
• Monitor appliance processes for unexpected child processes, shell activity, or outbound connections from the device.
• Alert on crashes or restarts of the web service that coincide with anomalous HTTP traffic.
• Review authentication and admin logs for post-exploitation activity such as new accounts or configuration changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.