PT-2025-25272 · Trend Micro · Trend Micro Apex Central

Chudypb + 1 · Published 2024-11-15 · Updated 2025-09-08 · CVE-2025-49220

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Apex Central versions prior to 8.0.7007

Description The issue is related to an insecure deserialization operation, which could lead to a pre-authentication remote code execution on affected installations. This vulnerability is similar to another issue but affects a different method.

Recommendations For versions prior to 8.0.7007, update to version 8.0.7007 or later to resolve the issue. As a temporary workaround, consider restricting access to the ConvertFromJson deserialization method until a patch is available.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-477

CWE-20

Related Identifiers

BDU:2025-08897

CVE-2025-49220

ZDI-25-367

Affected Products

Trend Micro Apex Central

References · 21

• https://zerodayinitiative.com/advisories/ZDI-25-367 · Security Note
• https://success.trendmicro.com/en-US/solution/KA-0019926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49220 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49220 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08897 · Security Note
• https://t.me/cveNotify/134698 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1933443381897679028 · Twitter Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-25495 · Note
• https://twitter.com/CVEnew/status/1935043016454197537 · Twitter Post
• https://t.me/true_secator/7129 · Telegram Post
• https://twitter.com/CCBalert/status/1934631955598897323 · Twitter Post
• https://t.me/cveNotify/134697 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1933016034463940994 · Twitter Post
• https://t.me/cvetracker/26437 · Telegram Post
• https://twitter.com/autumn_good_35/status/1933149491353563565 · Twitter Post