CVE-2017-6339

Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority (CA) and dynamically generates digital certificates that are sent to client browsers to complete a secure passage for HTTPS connections. It also allows administrators to upload their own certificates signed by a root CA. An attacker with low privileges can download the current CA certificate and Private Key (either the default ones or ones uploaded by administrators) and use those to decrypt HTTPS traffic, thus compromising confidentiality. Also, the default Private Key on this appliance is encrypted with a very weak passphrase. If an appliance uses the default Certificate and Private Key provided by Trend Micro, an attacker can simply download these and decrypt the Private Key using the default/weak passphrase.

• CWE-269
• CWE-521

• http://www.securityfocus.com/bid/97492Third Party Advisory, VDB Entry
• https://success.trendmicro.com/solution/1116960Patch, Vendor Advisory
• https://www.qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdfExploit, Technical Description, Third Party Advisory
• http://www.securityfocus.com/bid/97492Third Party Advisory, VDB Entry
• https://success.trendmicro.com/solution/1116960Patch, Vendor Advisory
• https://www.qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdfExploit, Technical Description, Third Party Advisory

Published

Apr 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6329Symantec VIP Access for Desktop prior to 2.2.4 can be suscep…
• CVE-2017-6330Symantec Encryption Desktop before SED 10.4.1MP2 can allow r…
• CVE-2017-6331Prior to SEP 14 RU1 Symantec Endpoint Protection product can…7.1
• CVE-2017-6334dnslookup.cgi on NETGEAR DGN2200 devices with firmware throu…8.8
• CVE-2017-6335The QuantumTransferMode function in coders/tiff.c in Graphic…
• CVE-2017-6338Multiple Access Control issues in Trend Micro InterScan Web …
• CVE-2017-6340Trend Micro InterScan Web Security Virtual Appliance (IWSVA)…
• CVE-2017-6341Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.…
• CVE-2017-6342An issue was discovered on Dahua DHI-HCVR7216A-S3 devices wi…
• CVE-2017-6343The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR…
• CVE-2017-6344XML External Entity (XXE) vulnerability in Grails PDF Plugin…
• CVE-2017-6345The LLC subsystem in the Linux kernel before 4.9.13 does not…