CVE-2025-54948

Published Aug 5, 2025

Last updated a month ago

Trend Micro Apex One

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54948 is a command injection vulnerability that affects the on-premise version of Trend Micro Apex One. It exists within the Apex One management console, which listens on TCP ports 8080 and 4343 by default. The vulnerability stems from the lack of proper validation of a user-supplied string before using it to execute a system call. A pre-authenticated remote attacker could exploit this vulnerability to upload malicious code and execute commands on affected installations. This could allow an attacker to execute code in the context of IUSR. Trend Micro has observed attempts to actively exploit this vulnerability in the wild. A temporary fix is available, and a formal patch is expected in mid-August 2025.

Description: A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.
Source: security@trendmicro.com
NVD status: Analyzed
Products: apex_one

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Trend Micro Apex One OS Command Injection Vulnerability
Exploit added on: Aug 18, 2025
Exploit action due: Sep 8, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security@trendmicro.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:on-premises:windows:*:*",
            "vulnerable": true,
            "matchCriteriaId": "84F26044-A0BB-442E-93BD-E836B4DD71F4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.