PT-2025-25271 · Trend Micro · Trend Micro Apex Central

Published 2024-11-13 · Updated 2025-09-08 · CVE-2025-49219

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Trend Micro Apex Central versions prior to 8.0.7007

Description The issue is related to an insecure deserialization operation in Trend Micro Apex Central, which could lead to a pre-authentication remote code execution on affected installations.

Recommendations For versions prior to 8.0.7007, update to version 8.0.7007 or later to resolve the issue. As a temporary workaround, consider restricting access to the GetReportDetailView function until a patch is available.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-477

CWE-20

Related Identifiers

BDU:2025-08896

CVE-2025-49219

ZDI-25-366

Affected Products

Trend Micro Apex Central

References · 18

• https://zerodayinitiative.com/advisories/ZDI-25-366 · Security Note
• https://success.trendmicro.com/en-US/solution/KA-0019926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49219 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49219 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08896 · Security Note
• https://twitter.com/TweetThreatNews/status/1933443381897679028 · Twitter Post
• https://t.me/cveNotify/134698 · Telegram Post
• https://t.me/true_secator/7129 · Telegram Post
• https://twitter.com/CCBalert/status/1934631955598897323 · Twitter Post
• https://t.me/cveNotify/134697 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1933016034463940994 · Twitter Post
• https://t.me/cvetracker/26437 · Telegram Post
• https://twitter.com/autumn_good_35/status/1933149491353563565 · Twitter Post
• https://twitter.com/CVEnew/status/1935043017452523537 · Twitter Post
• https://twitter.com/CveFindCom/status/1935369992578478233 · Twitter Post