EUVD-2025-18519
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.
Analysis
Local File Inclusion (LFI) vulnerability in Trend Micro Apex Central widgets that enables remote code execution (RCE) on affected systems. This vulnerability affects Trend Micro Apex Central installations below version 8.0.6955 and requires an authenticated attacker with low privileges to exploit. The vulnerability combines LFI with RCE capabilities, representing a significant threat to organizations using vulnerable Apex Central deployments.
Technical Context
This vulnerability exploits improper input validation in Trend Micro Apex Central's widget handling mechanism, classified under CWE-475 (Undefined Behavior). The root cause involves inadequate sanitization of file path parameters within widget processing logic, allowing attackers to traverse the file system and include arbitrary local files. This LFI can be chained with file upload or code execution mechanisms to achieve remote code execution. The vulnerability affects the widget component architecture of Apex Central, which handles administrative functions and security policy management across enterprise endpoints.
Affected Products
Trend Micro Apex Central versions below 8.0.6955. The vulnerability specifically impacts the widget component used in administrative interfaces. Affected deployments include: Trend Micro Apex Central 8.0.6954 and all earlier versions. Organizations running Apex Central in Security Virtual Appliance (SVA) or as a standalone server installation are impacted. The vulnerability affects both on-premises and cloud-hosted Apex Central instances that have not been patched to version 8.0.6955 or later.
Remediation
Immediate remediation: Upgrade Trend Micro Apex Central to version 8.0.6955 or later. Organizations unable to patch immediately should: (1) Restrict network access to Apex Central administrative interfaces using firewall rules and VPN requirements; (2) Enforce strong authentication mechanisms and multi-factor authentication for all Apex Central administrative accounts; (3) Monitor widget processing logs for suspicious file path traversal patterns; (4) Implement file integrity monitoring on Apex Central installation directories; (5) Review access logs for accounts showing unusual widget activity or file inclusion attempts. Consult Trend Micro security advisory for detailed patch deployment procedures and version verification steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today