CVE-2025-54948

critical

Description

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

From the Tenable Blog

CVE-2025-54987, CVE-2025-54948: Trend Micro Apex One Command Injection Zero-Days Exploited In The Wild

Published: 2025-08-06

Trend Micro releases a temporary mitigation tool to reduce exposure to two unpatched zero-day command injection vulnerabilities which have been exploited.

References

https://securityaffairs.com/181283/hacking/u-s-cisa-adds-trend-micro-apex-one-flaw-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2025/08/18/cisa-adds-one-known-exploited-vulnerability-catalog

https://www.theregister.com/2025/08/10/infosec_in_brief/

https://www.securityweek.com/trend-micro-patches-apex-one-vulnerabilities-exploited-in-wild/

https://www.infosecurity-magazine.com/news/attackers-critical-apex-one/

https://www.helpnetsecurity.com/2025/08/06/trend-micro-apex-one-flaws-exploted-in-the-wild-cve-2025-54948-cve-2025-54987/

https://www.darkreading.com/vulnerabilities-threats/attackers-exploit-trend-micro-apex-one-zero-day-flaw

https://www.bleepingcomputer.com/news/security/trend-micro-warns-of-endpoint-protection-zero-day-exploited-in-attacks/

https://thehackernews.com/2025/08/trend-micro-confirms-active.html

https://securityaffairs.com/180856/hacking/trend-micro-fixes-two-actively-exploited-apex-one-rce-flaws.html

https://www.tenable.com/blog/cve-2025-54987-cve-2025-54948-trend-micro-apex-one-command-injection-zero-days-exploited

https://success.trendmicro.com/en-US/solution/KA-0020652

Details

Source: Mitre, NVD

Published: 2025-08-05

Updated: 2025-08-19

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest

Detections

Analytics