Skip to main content

Trend Micro CVE-2025-47865

| EUVD-2025-18519 HIGH
Undefined Behavior for Input to API (CWE-475)
2025-06-17 security@trendmicro.com
RCE LFI Trend Micro Apex Central
7.5
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Apr 16, 2026 - 06:38 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
8.0.6955
EUVD ID Assigned
Mar 14, 2026 - 22:15 euvd
EUVD-2025-18519
Analysis Generated
Mar 14, 2026 - 22:15 vuln.today
CVE Published
Jun 17, 2025 - 18:15 nvd
HIGH 7.5

DescriptionNVD

A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.

AnalysisAI

Local File Inclusion (LFI) vulnerability in Trend Micro Apex Central widgets that enables remote code execution (RCE) on affected systems. This vulnerability affects Trend Micro Apex Central installations below version 8.0.6955 and requires an authenticated attacker with low privileges to exploit. The vulnerability combines LFI with RCE capabilities, representing a significant threat to organizations using vulnerable Apex Central deployments.

Technical ContextAI

This vulnerability exploits improper input validation in Trend Micro Apex Central's widget handling mechanism, classified under CWE-475 (Undefined Behavior). The root cause involves inadequate sanitization of file path parameters within widget processing logic, allowing attackers to traverse the file system and include arbitrary local files. This LFI can be chained with file upload or code execution mechanisms to achieve remote code execution. The vulnerability affects the widget component architecture of Apex Central, which handles administrative functions and security policy management across enterprise endpoints.

RemediationAI

Immediate remediation: Upgrade Trend Micro Apex Central to version 8.0.6955 or later. Organizations unable to patch immediately should: (1) Restrict network access to Apex Central administrative interfaces using firewall rules and VPN requirements; (2) Enforce strong authentication mechanisms and multi-factor authentication for all Apex Central administrative accounts; (3) Monitor widget processing logs for suspicious file path traversal patterns; (4) Implement file integrity monitoring on Apex Central installation directories; (5) Review access logs for accounts showing unusual widget activity or file inclusion attempts. Consult Trend Micro security advisory for detailed patch deployment procedures and version verification steps.

Share

CVE-2025-47865 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy