CVE-2020-28579: Trend Micro InterScan Web Security Virtual Appliance out-of-bounds write RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with elevated privileges on a security appliance, high EPSS, and a public exploit reference, though it requires valid credentials and is not in KEV.

What it is

Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 contains an out-of-bounds write (CWE-787) reachable through a specially crafted HTTP message. An authenticated remote attacker can trigger it to run code with elevated privileges, making it a serious post-authentication compromise path on a security gateway.

Impact

Successful exploitation gives the attacker remote code execution with elevated privileges on the appliance, allowing full control of the device and any traffic or credentials it handles.

Attack surface

Reached over the network via HTTP (CVSS vector AV:N/AC:L/PR:L/UI:N), so the attacker needs valid low-privileged credentials but no user interaction. The flaw is in HTTP message handling on the appliance.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is high (0.507, ~98.9th percentile) and a third-party advisory carries an Exploit tag, indicating public exploit research exists.

What to do

• Apply the Trend Micro vendor fix referenced in advisory 000281954 for InterScan Web Security Virtual Appliance 6.5 SP2.
• Restrict management and HTTP interface access to trusted networks; do not expose the appliance to the internet.
• Enforce least privilege and strong unique credentials for appliance accounts, and audit for unnecessary accounts.
• Monitor vendor advisories for updated builds and re-verify the patch level after upgrading.

Detection

• Inspect appliance and web logs for malformed or oversized HTTP requests targeting the management/HTTP interface.
• Alert on unexpected child processes or command execution spawned by the appliance's web service.
• Monitor for anomalous outbound connections or file writes from the appliance host.
• Correlate authentication events with subsequent HTTP request anomalies from the same source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.