CVE-2008-2439

CVE-2008-2439 describes a directory traversal vulnerability in the UpdateAgent function of the OfficeScanNT Listener service (TmListen.exe) within Trend Micro OfficeScan and Worry-Free Business Security products. This flaw allows unauthenticated remote attackers to read arbitrary files on affected systems by injecting directory traversal sequences into HTTP requests. The vulnerability carries a CVSS score of 5.0 (Medium), indicating a low attack complexity and no authentication required, with a potential impact of partial confidentiality loss. The EPSS score of 0.44618 suggests a moderate likelihood of exploitation. While not on the CISA KEV catalog or Hot List, exploit code is publicly available via a Metasploit module, indicating a clear path for attackers. Despite this, there is no recorded social media discussion or media coverage, suggesting limited public awareness or active exploitation.