EUVD-2025-18517Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations.
AnalysisAI
Local File Inclusion (LFI) vulnerability in Trend Micro Apex Central widgets (versions below 8.0.6955) that allows authenticated attackers to include and execute arbitrary PHP files, achieving remote code execution on affected systems. The vulnerability requires low-level user authentication and moderate attack complexity but carries high impact across confidentiality, integrity, and availability. Active exploitation status and proof-of-concept availability have not been confirmed from the provided data, but the authentication requirement and network accessibility make this a credible threat to deployed Apex Central instances.
Technical ContextAI
This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which manifests as a Local File Inclusion flaw in Trend Micro Apex Central's widget processing logic. The widget component fails to properly validate or sanitize user-supplied file path inputs before including them via PHP's file inclusion mechanisms (likely include(), require(), or similar functions). An attacker with valid credentials can craft malicious requests to the widget to traverse the filesystem and include arbitrary files, which are then processed as PHP code within the application context. The vulnerability affects Apex Central versions prior to 8.0.6955, indicating the fix was incorporated in the patch release. CPE identification would be: cpe:2.3:a:trendmicro:apex_central:*:*:*:*:*:*:*:* (versions <8.0.6955).
RemediationAI
- Immediate patch: Update Trend Micro Apex Central to version 8.0.6955 or later. 2) Interim mitigations (if patching is delayed): Restrict network access to Apex Central administrative interfaces using firewall rules; limit widget functionality access to trusted internal networks only; enforce strong authentication and monitor for unusual widget access patterns. 3) Post-remediation: Verify patch installation across all Apex Central instances; audit logs for evidence of exploitation attempts (look for unusual file inclusion requests in widget components); review user access logs for suspicious authenticated activity. 4) Vendor reference: Contact Trend Micro support or review the official Apex Central security advisory for patch download links and detailed deployment guidance specific to your environment.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today