Read the docs
TI-2008-02337 Aliases CVE-2008-2437GHSA-fp34-3782-rcvm

Stack-based buffer overflow in cgiRecvFile.exe in Trend Micro OfficeScan 7.3 patch 4…

Priority MEDIUM 52CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Stack-based buffer overflow in cgiRecvFile.exe in Trend Micro OfficeScan 7.3 patch 4 build 1362 and other builds, OfficeScan 8.0 and 8.0 SP1, and Client Server Messaging Security 3.6 allows remote attackers to execute arbitrary code via an HTTP request containing a long ComputerName parameter.

Why it matters now

EPSS 0.06673 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:trend_micro:client-server-messaging_security:2.0:*:*:*:*:*:*:*2.0VulnerableTrend Micro
cpe:2.3:a:trend_micro:client-server-messaging_security:3.0:*:*:*:*:*:*:*3.0VulnerableTrend Micro
cpe:2.3:a:trend_micro:client-server-messaging_security:3.5:*:*:*:*:*:*:*3.5VulnerableTrend Micro
cpe:2.3:a:trend_micro:client-server-messaging_security:3.6:*:*:*:*:*:*:*3.6VulnerableTrend Micro
cpe:2.3:a:trend_micro:officescan:7.0:*:*:*:*:*:*:*7.0VulnerableTrend Micro
cpe:2.3:a:trend_micro:officescan:7.3:*:*:*:*:*:*:*7.3VulnerableTrend Micro
cpe:2.3:a:trend_micro:officescan:7.3:patch_4:*:*:*:*:*:*7.3 patch_4VulnerableTrend Micro
cpe:2.3:a:trend_micro:officescan:8.0:*:*:*:*:*:*:*8.0VulnerableTrend Micro
cpe:2.3:a:trend_micro:officescan:8.0:sp1:*:*:*:*:*:*8.0 sp1VulnerableTrend Micro
  • cpe:2.3:a:trend_micro:client-server-messaging_security:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Trend Micro
  • cpe:2.3:a:trend_micro:client-server-messaging_security:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Trend Micro
  • cpe:2.3:a:trend_micro:client-server-messaging_security:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Trend Micro
  • cpe:2.3:a:trend_micro:client-server-messaging_security:3.6:*:*:*:*:*:*:* Versions 3.6 Vulnerable ·Trend Micro
  • cpe:2.3:a:trend_micro:officescan:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Trend Micro
  • cpe:2.3:a:trend_micro:officescan:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Trend Micro
  • cpe:2.3:a:trend_micro:officescan:7.3:patch_4:*:*:*:*:*:* Versions 7.3 patch_4 Vulnerable ·Trend Micro
  • cpe:2.3:a:trend_micro:officescan:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Trend Micro
  • cpe:2.3:a:trend_micro:officescan:8.0:sp1:*:*:*:*:*:* Versions 8.0 sp1 Vulnerable ·Trend Micro

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-2437
  2. 2026-10-03 Alias added: GHSA-fp34-3782-rcvm

References

Advisory 1

Other 6

  • TI-2007-00316 Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl… CVSS 2.0HIGH 9.3
  • TI-2007-00833 TmComm.sys 1.5.0.1052 in the Trend Micro Anti-Rootkit Common Module (RCM), with the… CVSS 2.0HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences