A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.
An attacker without any authentication gains access to the internal Snowservice API interface, which is improperly exposed on the network. Through a command injection vulnerability, it is possible to inject and execute arbitrary system commands. These commands are executed in the context of the root user, meaning full operating system privileges.
An attacker can gain full control over the system by executing arbitrary code with root privileges β enabling data theft, configuration modification, backdoor installation, and further lateral movement within the infrastructure.
Apply patches available from the vendor according to references (Trellix Knowledge Base article #000014058). Urgent update is recommended along with restricting network access to ESM API interfaces exclusively to trusted IP addresses until the patch is implemented.
Trellix Enterprise Security Manager (ESM) version 11.6.10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HTrellix Enterprise Security Manager
APPTrellix11.6.10
Related vulnerabilities
A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to im...
An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9...
An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized speci...
A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomple...
A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authentica...