CVE-2020-28581: Trend Micro InterScan Web Security Virtual Appliance command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote authenticated command execution with high confidentiality, integrity and availability impact, a public exploit reference, and very high EPSS despite no KEV listing.

What it is

ModifyVLANItem in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 fails to neutralize input before passing it to the operating system, allowing OS command injection. An authenticated remote attacker can send crafted HTTP messages that run arbitrary commands with elevated privileges on the appliance.

Impact

An attacker with valid credentials gains arbitrary OS command execution at elevated privilege on the security appliance, enabling full compromise of the device and any data or traffic it handles.

Attack surface

Reached over the network via HTTP requests to the ModifyVLANItem function; the CVSS vector (AV:N/PR:H/UI:N) indicates a remote attacker who already holds high-level credentials and requires no user interaction.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but a public exploit reference exists (Tenable advisory tagged Exploit) and EPSS is 0.44953 (98.7th percentile), indicating elevated likelihood of exploitation.

What to do

• Apply the vendor fix from Trend Micro solution 000281954 for InterScan Web Security Virtual Appliance 6.5 SP2.
• Restrict management interface access to trusted networks and disable it from untrusted exposure.
• Enforce least privilege and strong unique credentials for appliance administrative accounts.
• Monitor and audit administrative HTTP requests to the ModifyVLANItem endpoint.
• If patching is delayed, isolate the appliance on a segmented management VLAN.

Detection

• Alert on HTTP requests to ModifyVLANItem containing shell metacharacters (;, |, &&, $(), backticks).
• Monitor appliance process trees for unexpected child processes spawned by the web service.
• Review appliance and web server logs for anomalous administrative requests from unusual source IPs.
• Baseline and alert on outbound connections from the appliance to unexpected destinations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.