Apex One: OS Command Injection in Trend Micro Apex One management console (CVE-2025-54948) #shorts

Summary

In today’s episode, we dive into CVE-2025-54948, a critical pre-authenticated command injection vulnerability in Trend Micro Apex One on-premise management console. Active exploitation in the wild has prompted Trend Micro to issue warnings, provide a temporary mitigation tool, and schedule a full patch release in mid-August 2025.

Product details

Trend Micro Apex One is an endpoint security platform widely deployed in enterprise environments. The affected version is Apex One 2019 (14.0) prior to build 14.0.0.14039. Customers running the on-premise management console in those versions are at risk and should take immediate action.

Vulnerability type summary

CVE-2025-54948 is categorized under CWE-78: OS Command Injection. This class of vulnerability allows attackers to craft input that gets passed directly to the operating system shell, enabling arbitrary command execution with the privileges of the vulnerable service.

Details of the vulnerability

A pre-authenticated remote attacker can exploit a flaw in the Apex One management console’s file upload and processing logic. By uploading specially constructed payloads, the attacker injects operating system commands that execute on the server. Trend Micro observed active in-the-wild exploitation targeting unpatched on-premise consoles, demonstrating full control over the management interface and potentially the secured endpoints.

Conclusion

Organizations using Trend Micro Apex One on-premise should immediately apply the temporary mitigation tool released by Trend Micro and plan to update to the official patch when it becomes available in mid-August 2025. Regularly reviewing vendor advisories, maintaining timely updates, and monitoring for unusual management console activity are key steps to mitigate the risk of command injection and similar zero-day exploits.

This chain involves the following actors

• Remote Attacker: Pre-authenticated intruder exploiting the management console

This following systems are involved

• Trend Micro Apex One Management Console (On-premise endpoint protection management): Hosts the vulnerable web-based file upload and command execution interface

Attack entry point

• File Upload Endpoint: Unauthenticated HTTP endpoint used for uploading console plugins and policy files

Remediation actions

Exploitation actions

• https://success.trendmicro.com/en-US/solution/KA-0020652
• [2025-08-06] Trend Micro releases a temporary mitigation tool for two exploited zero-day command injection vulnerabilities in Apex One.
• [2025-08-06] Trend Micro warns of unauthenticated command injection vulnerabilities in Apex One being exploited in the wild, with a patch expected in mid-August 2025.
• [2025-08-07] Trend Micro warns of actively exploited critical vulnerabilities in Apex One endpoint security product.