CVE-2025-54987

Published Aug 5, 2025

Last updated 9 days ago

Trend Micro Apex One

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-54987 is a command injection vulnerability affecting the on-premise version of Trend Micro Apex One. It exists within the Apex One management console and could allow a pre-authenticated, remote attacker to upload malicious code and execute commands on affected installations. The vulnerability arises from the lack of proper validation of a user-supplied string before using it to execute a system call. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture. An attacker must have access to the Trend Micro Apex One Management Console to leverage this vulnerability. Trend Micro has observed at least one instance of an attempt to actively exploit one of these vulnerabilities in the wild.

Description: A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture.
Source: security@trendmicro.com
NVD status: Analyzed
Products: apex_one

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@trendmicro.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:on-premises:windows:*:*",
            "vulnerable": true,
            "matchCriteriaId": "84F26044-A0BB-442E-93BD-E836B4DD71F4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.