Vulnerability

CERT-In Vulnerability Note CIVN-2025-0127
Multiple Vulnerabilities in Trend Micro products

Original Issue Date:June 16, 2025

Severity Rating: CRITICAL

Systems Affected

Trend Micro Apex Central 2019 (On-prem)
Trend Micro Apex Central as a Service (SaaS)
Trend Micro Apex One 2019 (On-prem)
Trend Micro Apex One as a Service (SaaS)

Overview

Multiple Vulnerabilities have been reported in Trend Micro products which could allow the attacker to elevate privileges, improper access control and remote code execution on targeted systems.

Target Audience:
All organizations and individuals using Trend Micro products.

Risk Assessment:
High risks of system compromise and unauthorized access.

Impact Assessment:
Potential for remote code execution and privilege escalation of system.

Description

Trend Micro Inc. is an American-Japanese cyber security software company. The company develops enterprise security software for servers, containers, and cloud computing environments, networks, and end points.

1. Remote Code Execution Vulnerability ( CVE-2025-49219   CVE-2025-49220   )

These vulnerabilities exist in Trend Micro Apex Central software due to insecure input validation when processing serialized data. An attacker could exploit these vulnerabilities by sending specially crafted data to an affected device.
Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary code on the target system.

2. Improper Access Control Vulnerability ( CVE-2025-49154   )

A vulnerability exists in Trend Micro Apex One software due to improper access restrictions. An attacker could exploit this vulnerability by overwriting key memory-mapped files.
Successful exploitation of this vulnerability could allow the attacker to escalate privileges on the targeted system.

3. Privilege Escalation Vulnerability ( CVE-2025-49158   )

A vulnerability exists in Trend Micro Apex One software due to usage of an untrusted search path. An attacker could exploit this vulnerability by placing a malicious binary into a specific location on the system.
Successful exploitation of this vulnerability could allow the attacker to escalate privileges on the targeted system.

4. Remote Code Execution Vulnerability ( CVE-2025-49155   )

A vulnerability exists in Trend Micro Apex One software due to the application loads DLL libraries in an insecure manner. An attacker could exploit this vulnerability by executing specially crafted .dll file on targeted system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on victims system.

5. Privilege Escalation Vulnerability ( CVE-2025-49156   CVE-2025-49157   )

These vulnerabilities exist in Trend Micro Apex One software due to an insecure link following vulnerabilities in the scan engine and damage clean-up engine, respectively. An attacker could exploit these vulnerabilities by creating a specially crafted symbolic link to a critical file on the targeted system.
Successful exploitation of these vulnerabilities could allow the attacker to escalate privileges of an affected device.

Solution

Apply appropriate updates as mentioned in:
https://success.trendmicro.com/en-US/solution/KA-0019926

https://success.trendmicro.com/en-US/solution/KA-0019917

Vendor Information

Trend Micro
https://success.trendmicro.com/en-US/solution/KA-0019926
https://success.trendmicro.com/en-US/solution/KA-0019917

References

Trend Micro
https://success.trendmicro.com/en-US/solution/KA-0019926
https://success.trendmicro.com/en-US/solution/KA-0019917

CVE Name
CVE-2025-49219
CVE-2025-49220
CVE-2025-49154
CVE-2025-49158
CVE-2025-49155
CVE-2025-49156
CVE-2025-49157

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India