This module exploits two vulnerabilities in Trend Micro Threat Discovery Appliance. The first is an authentication bypass vulnerability via a file delete in logoff.cgi which resets the admin password back to 'admin' upon a reboot. This is useful if the password for the admin user is unknown. The second is an authenticated command injection flaw using the timezone parameter in the admin_sys_time.cgi interface.
Monday, April 24, 2017 - 00:00