GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

2025-0805-TM-A1-002

Vulnerability from csaf_trendmicro - Published: 2025-08-05 10:00 - Updated: 2025-08-05 10:00
Summary
ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One (On-Premise) Management Console Command Injection RCE Vulnerabilities
Notes
Title: ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One (On-Premise) Management Console Command Injection RCE Vulnerabilities
CVE-2025-54948

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
Apex One
Trend Micro / Apex One
 2019
Vendor Fix fix
Vendor Fix fix
Product Identifier Version Remediation
Apex One as a Service
Trend Micro / Apex One as a Service
 SaaS
Vendor Fix fix
CVE-2025-54987

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture.

9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Known affected 1 product, the same list as for CVE-2025-54948
Fixed 1 product, the same list as for CVE-2025-54948
References
Acknowledgments
Trend Micro Incident Response (IR) Team Jacky Hsieh @ CoreCloud Tech working with Trend Zero Day Initiative
Jacky Hsieh @ CoreCloud Tech working with Trend Zero Day Initiative
To clipboard 

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One (On-Premise) Management Console Command Injection RCE Vulnerabilities",
        "title": "Title"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@trendmicro.com",
      "issuing_authority": "Trend Micro PSIRT",
      "name": "Trend Micro",
      "namespace": "https://www.trendmicro.com/vulnerability"
    },
    "references": [
      {
        "category": "self",
        "summary": "Trend Micro Security Bulletin",
        "url": "https://success.trendmicro.com/en-US/solution/KA-0020652"
      }
    ],
    "title": "ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One (On-Premise) Management Console Command Injection RCE Vulnerabilities",
    "tracking": {
      "current_release_date": "2025-08-05T10:00:00.000Z",
      "generator": {
        "date": "2025-09-05T14:25:10.649Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.34"
        }
      },
      "id": "2025-0805-TM-A1-002",
      "initial_release_date": "2025-08-05T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-08-05T10:00:00.000Z",
          "number": "1",
          "summary": "Initial version."
        },
        {
          "date": "2025-08-15T19:00:00.000Z",
          "number": "2",
          "summary": "Updated solution"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2019",
                "product": {
                  "name": "Apex One",
                  "product_id": "TM-A1-001"
                }
              }
            ],
            "category": "product_name",
            "name": "Apex One"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "SaaS",
                "product": {
                  "name": "Apex One as a Service",
                  "product_id": "TM-A1SAAS-001"
                }
              }
            ],
            "category": "product_name",
            "name": "Apex One as a Service"
          }
        ],
        "category": "vendor",
        "name": "Trend Micro"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Trend Micro Incident Response (IR) Team",
            "Jacky Hsieh @ CoreCloud Tech working with Trend Zero Day Initiative"
          ]
        }
      ],
      "cve": "CVE-2025-54948",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1SAAS-001"
        ],
        "known_affected": [
          "TM-A1-001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-27834",
          "url": "https://www.zerodayinitiative.com/advisories/published/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-05T19:00:00.000Z",
          "details": "FixTool_Aug2025",
          "product_ids": [
            "TM-A1-001"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0020652"
        },
        {
          "category": "vendor_fix",
          "date": "2025-07-31T19:00:00.000Z",
          "details": "Backend Mitigation Applied",
          "product_ids": [
            "TM-A1SAAS-001"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0020652"
        },
        {
          "category": "vendor_fix",
          "date": "2025-08-15T19:00:00.000Z",
          "details": "SP1 CP B14081",
          "product_ids": [
            "TM-A1-001"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0020652"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.4,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.4,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1SAAS-001"
          ]
        }
      ],
      "title": "Management Console Command Injection RCE Vulnerability"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jacky Hsieh @ CoreCloud Tech working with Trend Zero Day Initiative"
          ]
        }
      ],
      "cve": "CVE-2025-54987",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "TM-A1SAAS-001"
        ],
        "known_affected": [
          "TM-A1-001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "ZDI-CAN-27855",
          "url": "https://www.zerodayinitiative.com/advisories/published/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-08-05T19:00:00.000Z",
          "details": "FixTool_Aug2025",
          "product_ids": [
            "TM-A1-001"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0020652"
        },
        {
          "category": "vendor_fix",
          "date": "2025-07-31T19:00:00.000Z",
          "details": "Backend Mitigation Applied",
          "product_ids": [
            "TM-A1SAAS-001"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0020652"
        },
        {
          "category": "vendor_fix",
          "date": "2025-08-15T19:00:00.000Z",
          "details": "SP1 CP B14081",
          "product_ids": [
            "TM-A1-001"
          ],
          "url": "https://success.trendmicro.com/en-US/solution/KA-0020652"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.4,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.4,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "TM-A1-001",
            "TM-A1SAAS-001"
          ]
        }
      ],
      "title": "Management Console Command Injection RCE Vulnerability"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.