EUVD-2025-18530CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.
Analysis
CVE-2025-49155 is an uncontrolled search path vulnerability in Trend Micro Apex One's Data Loss Prevention (DLP) module that allows unauthenticated remote attackers to inject and execute arbitrary code. The vulnerability requires user interaction (CVSS UI:R) but poses critical risk to organizations deploying Apex One, as successful exploitation grants full system compromise with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation likelihood should be assessed against current threat intelligence for active in-the-wild usage.
Technical Context
The vulnerability stems from CWE-427 (Uncontrolled Search Path Element), a path traversal/search path injection flaw where the Apex One DLP module fails to properly validate or sanitize the search path used for loading libraries or executable code. This class of vulnerability typically occurs when an application dynamically constructs file paths without proper canonicalization or validation, allowing attackers to inject relative paths, symbolic links, or malicious library names that the system will load from an attacker-controlled location. In the context of Trend Micro Apex One (Enterprise security/endpoint protection platform running on Windows/Linux systems), the DLP module likely uses dynamic loading mechanisms or search procedures that can be redirected to load attacker-supplied malicious code, bypassing intended security boundaries. The vulnerability is remotely triggerable (AV:N) with low attack complexity (AC:L), suggesting the search path injection can be triggered through network-accessible interfaces without complex exploit conditions.
Affected Products
Trend Micro Apex One (all versions with Data Loss Prevention module enabled). Specific version ranges require vendor advisory consultation, but typically Apex One versions prior to patched releases (expected advisory: Trend Micro Security Bulletin or official Apex One release notes). Affected platforms: Windows and Linux endpoint/server installations running Apex One with DLP module active. CPE pattern would be approximately: cpe:2.3:a:trend_micro:apex_one:*:*:*:*:*:*:*:* (with DLP component) and cpe:2.3:a:trend_micro:apex_one_as_a_service:*:*:*:*:*:*:*:*. Consult official Trend Micro security advisories and Apex One product documentation for exact affected version numbers and patch availability.
Remediation
Immediate actions: (1) Consult Trend Micro official security advisory for CVE-2025-49155 (search Trend Micro Security Bulletin or Apex One release notes). (2) Apply the latest security patch for Apex One DLP module when released by Trend Micro. (3) Interim mitigations while patches are unavailable: restrict network access to Apex One administrative interfaces, disable DLP module if operationally feasible, monitor for suspicious library loading patterns or unexpected code execution. (4) Isolate or monitor systems with Apex One in high-risk environments (where users interact with external content). (5) Review Trend Micro's official patch documentation for deployment guidance, compatibility notes, and rollback procedures. Specific patch version and download links will be provided in vendor advisory (expected format: Apex One patch version X.X.X or hotfix).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today