On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
In plain language
Written by AI from the record
CVE-2016-7552 is a dangerous bug in the Trend Micro Threat Discovery Appliance (2.6.1062r1) where an outside attacker can delete files without logging in, potentially taking control or knocking your system offline. If you run this appliance, you should treat it as urgent and update it.
CVE-2016-7552 is an unauthenticated directory traversal issue in Trend Micro Threat Discovery Appliance (2.6.1062r1) triggered through a crafted session_id cookie, enabling arbitrary file deletion with root privileges (and potentially bypassing authentication/causing denial of service).
If you're affected
Arbitrary file deletion
Full system downtime
Security bypass risk
Service disruption
What is it
This is like a computer “mailbox” (a cookie called session_id) that the appliance reads in a dangerous way. A malicious message can trick it into pointing at files anywhere on the server, then delete them with the highest privileges. In real life, that can mean the security appliance stops working, or the attacker can potentially get around the protections the appliance is meant to enforce.
Who is affected
This matters if you run the Trend Micro Threat Discovery Appliance and are specifically on version 2.6.1062r1. The issue is remote and does not require a login, so it’s a risk even for systems used only internally if they are reachable from an attacker. It’s only a real risk if the vulnerable appliance is reachable by an attacker over the network (for example, accessible from the internet or any untrusted network).
How urgent is it
This should be treated as RED and handled immediately because the flaw allows remote, unauthenticated file deletion as root. Attackers don’t need valid credentials to trigger it. Public exploit details are not confirmed in the findings, but the bug’s impact is severe enough that you should patch/contain right away rather than waiting.
What to do — in detail
Confirm exposure and version
Log into the Trend Micro Threat Discovery Appliance administration interface.
Identify the installed software version and confirm whether it is 2.6.1062r1.
Also confirm how the appliance is reachable: is it exposed to the internet, VPN only, or strictly internal?
Determine and apply the fix
The available remediation guidance says to upgrade to a later version of the Threat Discovery Appliance software from Trend Micro.
Apply the vendor’s upgrade path for your deployment (maintenance window if the update requires a restart).
After the upgrade, re-check the installed version to ensure the system is no longer 2.6.1062r1.
Temporary mitigation while patching (if you can’t upgrade immediately)
Restrict network access so the appliance is not reachable from untrusted networks.
If the appliance is currently internet-accessible, remove public exposure (firewall rules, reverse proxy restrictions, or network ACLs) until it’s updated.
Validate after patching
Confirm the appliance services are running normally.
Check for signs of filesystem or service disruption (unexpected outages, errors in logs around authentication/session handling, or unusual admin behavior).
What to monitor
After the change, monitor logs related to session handling/cookies and any file operation errors during authentication or session lifecycle events.
Keep an eye on network access attempts to the appliance during the patch window and after it’s updated.
CISA KEV note
This CVE is not listed in the CISA KEV findings provided, so there is no KEV-driven due date from this dataset.
Technical context
Severity and type:
This is a critical directory traversal issue (CWE-22) affecting Trend Micro Threat Discovery Appliance 2.6.1062r1.
Mechanism / attack vector:
An attacker can craft a malicious session_id cookie value that causes directory traversal when the appliance processes it.
Because the operation is performed with root privileges, the attacker can delete arbitrary files.
The findings also note potential authentication bypass behavior and/or denial of service outcomes.
Exploitation status (from findings):
No CISA KEV entry was provided.
The exploitation finding is described as a “detection template only,” which means exploitation evidence is not fully demonstrated in the provided material.
Nevertheless, the impact is severe (root-level arbitrary file deletion), so the workflow treats it as RED.
Patch information:
The provided patch guidance is general: upgrade to a later Threat Discovery Appliance version supplied by Trend Micro; no exact fixed version number was included in the findings.
EPSS:
A predicted likelihood value was provided in the dataset, but it is not repeated here in public-facing guidance.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
