CVE-2025-71211: Trend Micro Apex One Console Directory Traversal Remote Code Execution Vulnerability
A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Apex One console, which listens on TCP ports 8080 and 4343 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of IUSR.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Trend Micro Apex One Management Console ports TCP 8080 and 4343 (e.g., source IP restrictions / firewall ACLs) because an attacker must have console access; mitigations are especially relevant when the console IP is exposed externally.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71211?
CVE-2025-71211 has a critical severity rating of 9.8.
How do I fix CVE-2025-71211?
To fix CVE-2025-71211, apply the latest patches provided by Trend Micro for the Apex One Management Console.
What systems are affected by CVE-2025-71211?
CVE-2025-71211 affects the Trend Micro Apex One Management Console and Trend Micro Apex One.
What type of vulnerability is CVE-2025-71211?
CVE-2025-71211 is a directory traversal vulnerability that can lead to remote code execution.
What are the potential consequences of CVE-2025-71211?
The potential consequences of CVE-2025-71211 include unauthorized execution of malicious code and compromise of affected systems.