CVE-2022-25330 Integer overflow in Trend Micro ServerProtect for EMC Celerra
Remote attackers can exploit integer overflows in Trend Micro ServerProtect Information Server to crash the process or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25330?
CVE-2022-25330 is a critical vulnerability in Trend Micro ServerProtect for EMC Celerra, published on 24 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the process or achieve remote code execution.
Weakness: CWE-190
Which versions are affected by CVE-2022-25330?
It affects 3 products.
Products include Trendmicro Serverprotect, Trendmicro Serverprotect for Network Appliance Filer, Trendmicro Serverprotect for Storage.
How do I fix CVE-2022-25330?
No fix has been published for CVE-2022-25330 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25330 being exploited?
There is no known exploitation of CVE-2022-25330 in the wild and no public exploit code.
Other vulnerabilities in Trend Micro ServerProtect for EMC Celerra
- CVE-2022-25329 Hardcoded credentials in Trend Micro ServerProtect for EMC Celerra
- CVE-2021-36745 Auth bypass in Trend Micro ServerProtect for EMC Celerra
- CVE-2017-9034 Code injection in n/a
- CVE-2020-24561 Command injection in Trend Micro ServerProtect for Linux
- CVE-2017-9033 Cross-site request forgery in n/a
Sources
Also known as GHSA-3r6p-fgmm-jf23.