« Volver al listado

CVE-2018-3608

Estado: ModificadaCrítica (9.8)—

A vulnerability in Trend Micro Maximum Security's (Consumer) 2018 (versions 12.0.1191 and below) User-Mode Hooking (UMH) driver could allow an attacker to create a specially crafted packet that could alter a vulnerable system in such a way that malicious code could be injected into other processes.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Trendmicro — Antivirus + SecurityTrendmicro — Internet SecurityTrendmicro — Maximum SecurityTrendmicro — OfficescanTrendmicro — Officescan MonthlyTrendmicro — Premium Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-3608",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": true,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Trend Micro",
          "product": "Trend Micro Maximum Security (Consumer)",
          "versions": [
            {
              "status": "affected",
              "version": "2018 (12.0.1191)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-07-06T19:29:00.590",
  "references": [
    {
      "url": "http://esupport.trendmicro.com/support/vb/solution/ja-jp/1120144.aspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120237.aspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "http://esupport.trendmicro.com/support/vb/solution/ja-jp/1120144.aspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120237.aspx",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Trend Micro Maximum Security's (Consumer) 2018 (versions 12.0.1191 and below) User-Mode Hooking (UMH) driver could allow an attacker to create a specially crafted packet that could alter a vulnerable system in such a way that malicious code could be injected into other processes."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el controlador UMH (User-Mode Hooking) en Trend Micro Maximum Security (Consumer) 2018 (en versiones 12.0.1191 y anteriores) podría permitir que un atacante cree un paquete especialmente manipulado que podría alterar un sistema vulnerable de forma que se pueda inyectar código malicioso en otros procesos."
    }
  ],
  "lastModified": "2026-06-17T01:57:32.987",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trendmicro:antivirus_\\+_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "778222A5-A3AD-4BE0-A204-D6544F55E7B2",
              "versionEndIncluding": "12.0.1191"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:internet_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1109CE36-9D6E-433B-9800-F16240BE8CB0",
              "versionEndIncluding": "12.0.1191"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:maximum_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B149DA9C-15A4-4F4C-A0FD-D7E5AD0152C8",
              "versionEndIncluding": "12.0.1191"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:premium_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAAD7168-20B1-4F3A-99FD-46D94DB38B1A",
              "versionEndIncluding": "12.0.1191"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trendmicro:officescan:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCB164BF-12B5-450F-9DDB-9A3FBD544F7C"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:officescan:12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A78EAEA-1C69-4EAA-A994-C12DD477A49F"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:officescan_monthly:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EAE1C68D-DF46-4CDD-AD49-DF8DC6FE12A2"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:officescan_monthly:12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC891DA1-CBE6-402B-A7C5-A3B9C9807E62"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@trendmicro.com"
}