How severe is CVE-2015-2873?

CVE-2015-2873 has a CVSS 2.0 base score of 5.5, rated medium severity.

Is CVE-2015-2873 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-2873?

CVE-2015-2873 primarily affects Trendmicro Deep Discovery Inspector. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-2873?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-2873 published?

CVE-2015-2873 was published on 2015-08-23 and last updated on 2026-06-17.

CVE-2015-2873

CVE-2015-2873 is a medium-severity vulnerability in Trendmicro Deep Discovery Inspector with a CVSS 2.0 base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-425.

Key facts

Severity: Medium (CVSS 2.0 base score 5.5)
EPSS exploit prediction: 3% (84th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-425
Affected product: Trendmicro Deep Discovery Inspector
Published: 2015-08-23
Last modified: 2026-06-17

Description

Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL, (2) whitelist URL, or (3) blacklist URL.

Frequently asked questions

What is CVE-2015-2873?: Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL, (2) whitelist URL, or (3) blacklist URL.
How severe is CVE-2015-2873?: CVE-2015-2873 has a CVSS 2.0 base score of 5.5, rated medium severity.
Is CVE-2015-2873 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-2873?: CVE-2015-2873 primarily affects Trendmicro Deep Discovery Inspector. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-2873?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2015-2873 published?: CVE-2015-2873 was published on 2015-08-23 and last updated on 2026-06-17.

References

Affected products (9)

cpe:2.3:a:trendmicro:deep_discovery_inspector:3.5:*:*:*:*:*:*:*
cpe:2.3:a:trendmicro:deep_discovery_inspector:3.5:*:*:ja:*:*:*:*
cpe:2.3:a:trendmicro:deep_discovery_inspector:3.5:*:*:zh:*:*:*:*
cpe:2.3:a:trendmicro:deep_discovery_inspector:3.6:*:*:*:*:*:*:*
cpe:2.3:a:trendmicro:deep_discovery_inspector:3.7:*:*:*:*:*:*:*
cpe:2.3:a:trendmicro:deep_discovery_inspector:3.7:*:*:ja:*:*:*:*
cpe:2.3:a:trendmicro:deep_discovery_inspector:3.7:*:*:zh:*:*:*:*
cpe:2.3:a:trendmicro:deep_discovery_inspector:3.8:*:*:*:*:*:*:*
cpe:2.3:a:trendmicro:deep_discovery_inspector:3.8:*:*:ja:*:*:*:*

More vulnerabilities in Trendmicro Deep Discovery Inspector

CVE-2024-46902 — High (CVSS 8.4): A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to…
CVE-2024-46903 — Medium (CVSS 6.5): A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to…
CVE-2021-25252 — Medium (CVSS 5.5): Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion…
CVE-2018-15365 — Medium (CVSS 5.4): A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow…
CVE-2015-2872 — Medium (CVSS 4.3): Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery…

All CVEs affecting Trendmicro Deep Discovery Inspector →

Other CWE-425 vulnerabilities

CVE-2025-26689 — Critical (CVSS 9.8): Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote…
CVE-2024-0204 — Critical (CVSS 9.8): Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via…
CVE-2022-45276 — Critical (CVSS 9.8): An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the…
CVE-2022-26279 — Critical (CVSS 9.8): EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
CVE-2021-36560 — Critical (CVSS 9.8): Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads…
CVE-2021-36745 — Critical (CVSS 9.8): A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for…

Browse all CWE-425 vulnerabilities →