EUVD-2025-18514
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
Analysis
Critical pre-authentication remote code execution vulnerability in Trend Micro Apex Central versions below 8.0.7007, caused by insecure deserialization in a specific method. The vulnerability allows unauthenticated remote attackers to execute arbitrary code with complete system compromise (confidentiality, integrity, and availability impact). With a CVSS score of 9.8 and network-based attack vector requiring no user interaction, this represents an immediately exploitable critical threat to exposed Apex Central installations.
Technical Context
The vulnerability stems from CWE-477 (Insecure Deserialization) in Trend Micro Apex Central's request handling mechanism. Insecure deserialization occurs when untrusted data is deserialized without proper validation, allowing attackers to instantiate arbitrary objects and execute malicious code during the deserialization process. This particular vulnerability affects a different method than the related CVE-2025-49219, suggesting multiple unsafe deserialization points exist within Apex Central's codebase. The vulnerability is pre-authentication, meaning the affected deserialization occurs before any user credential validation, making it exploitable from an unauthenticated network position. Affected versions are Trend Micro Apex Central prior to version 8.0.7007, likely spanning multiple minor versions of the 8.x branch and potentially earlier major versions.
Affected Products
Trend Micro Apex Central versions below 8.0.7007, including: Apex Central 8.0.0 through 8.0.7006 and all prior major versions. CPE likely includes cpe:2.3:a:trendmicro:apex_central:*:*:*:*:*:*:*:* with version constraints <8.0.7007. Specific affected configurations include: standard on-premises Apex Central deployments exposed to network access (cloud or internal), multi-tenant environments, and organizations using Apex Central for endpoint management across distributed systems.
Remediation
Immediate patching is the primary remediation: (1) Upgrade Trend Micro Apex Central to version 8.0.7007 or later; (2) Obtain patched binaries from Trend Micro's official security advisory and patch portal; (3) Apply patches according to Trend Micro's change management guidelines, noting any compatibility requirements with managed endpoints. Interim mitigations for organizations unable to patch immediately: (1) Implement network-level access controls restricting Apex Central communication to authorized management networks only; (2) Deploy WAF/IPS rules to detect and block deserialization payloads if signatures become available; (3) Monitor for suspicious deserialization patterns in application logs; (4) Isolate affected Apex Central instances from internet-facing networks; (5) Implement additional authentication layers or reverse proxies with credential requirements. Reference Trend Micro Security Bulletin or official advisory for detailed patch availability and testing requirements.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today