CVE-2016-6270

The handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to api/v1/cfg/oauth/save_identify_pfx/.

• CWE-77

• http://www.securityfocus.com/bid/95884Third Party Advisory, VDB Entry
• https://qkaiser.github.io/pentesting/trendmicro/2016/10/08/trendmicro-vmi/Exploit, Technical Description, Third Party Advisory
• https://success.trendmicro.com/solution/1115411Vendor Advisory
• http://www.securityfocus.com/bid/95884Third Party Advisory, VDB Entry
• https://qkaiser.github.io/pentesting/trendmicro/2016/10/08/trendmicro-vmi/Exploit, Technical Description, Third Party Advisory
• https://success.trendmicro.com/solution/1115411Vendor Advisory

Published

Jan 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6264Integer signedness error in libc/string/arm/memset.S in uCli…7.5
• CVE-2016-6265Use-after-free vulnerability in the pdf_load_xref function i…
• CVE-2016-6266ccca_ajaxhandler.php in Trend Micro Smart Protection Server …8.8
• CVE-2016-6267SnmpUtils in Trend Micro Smart Protection Server 2.5 before …8.8
• CVE-2016-6268Trend Micro Smart Protection Server 2.5 before build 2200, 2…7.8
• CVE-2016-6269Multiple directory traversal vulnerabilities in Trend Micro …9.1
• CVE-2016-6271The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows m…
• CVE-2016-6272XPath injection vulnerability in Epic MyChart allows remote …
• CVE-2016-6273The lmadmin component in Flexera FlexNet Publisher (aka Flex…
• CVE-2016-6276Citrix Linux Virtual Delivery Agent (aka VDA, formerly Linux…
• CVE-2016-6277NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Bet…8.8
• CVE-2016-6283Cross-site scripting (XSS) vulnerability in Atlassian Conflu…