CVE-2025-54948
Trend Micro Apex One OS Command Injection Vulnerability
Description
CVE-2025-54948 is a critical OS command injection vulnerability in the Trend Micro Apex One on-premise management console that allows an unauthenticated remote attacker to upload malicious code and execute arbitrary commands on affected installations. With a CVSS v3.1 base score of 9.4, this vulnerability poses an immediate threat to organizations relying on Apex One for endpoint security, as it enables attackers to compromise the very platform responsible for protecting the enterprise from threats. CISA has added CVE-2025-54948 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 8, 2025, and its EPSS score of 20.46% at the 95th percentile indicates a very high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trendmicro | apex one | 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://success.trendmicro.com/en-US/solution/KA-0020652(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54948(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
CVE-2025-54948 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. This weakness occurs when software incorporates user-supplied input into operating system commands without properly neutralizing shell metacharacters. In the Trend Micro Apex One management console, the vulnerability allows a pre-authenticated attacker to upload malicious code and execute arbitrary OS commands on the underlying server without any authentication requirement.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2025-54948 has near-maximum severity with devastating consequences for enterprise security. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and needs no user interaction (UI:N). Confidentiality (High): An attacker with command execution on the Apex One server gains access to the endpoint security management infrastructure, including detailed information about all managed endpoints, security configurations, detection rules, and potentially collected threat samples and quarantined malware. Integrity (Low): While direct integrity impact is rated low in the CVSS vector, the strategic position of an endpoint security management console means the attacker could disable protection policies, create exclusion rules for their malware, and manipulate detection settings to facilitate subsequent attacks across the entire managed endpoint fleet. Availability (High): The attacker can disrupt the Apex One service, leaving all managed endpoints without security updates, policy enforcement, and threat detection. Compromising an endpoint security platform is one of the highest-value targets for sophisticated attackers, as it provides both a foothold and the ability to blind defenders.
Exploit Maturity
CVE-2025-54948 is confirmed to be actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 8, 2025. The EPSS score of 20.46% at the 95th percentile places it in the top 5% of all vulnerabilities by exploitation probability, indicating widespread exploitation activity. Trend Micro has published a security advisory (KA-0020652) with patch information. Endpoint security management consoles are prime targets for advanced threat actors because compromising the security platform allows attackers to disable defenses across the entire organization simultaneously. The combination of pre-authentication access, remote code execution capability, and the strategic value of the Apex One platform makes this an exceptionally dangerous vulnerability that demands immediate remediation.
Remediation
-
Apply the Trend Micro security patch immediately. Install the update referenced in Trend Micro advisory KA-0020652. Given the pre-authentication nature of the vulnerability, this should be treated as an emergency patch with the highest priority.
-
Restrict access to the Apex One management console. Ensure the management console is not accessible from the internet. Implement firewall rules limiting access to authorized administrative workstations only. If remote access is required, mandate VPN connectivity before allowing access to the console.
-
Conduct a security audit of the Apex One server. If the management console was accessible from untrusted networks while running a vulnerable version, treat the server as potentially compromised. Investigate for malicious uploads, unauthorized processes, modified security policies, new exclusion rules, and signs of lateral movement.
-
Review endpoint protection policies. After patching, verify that all endpoint protection policies remain intact. Check for unauthorized exclusion rules, disabled detection modules, or modified security settings that an attacker may have introduced to facilitate further attacks across managed endpoints.
-
Implement defense-in-depth monitoring. Deploy network intrusion detection monitoring traffic to and from the Apex One server. Set up alerts for unexpected outbound connections, unusual file uploads, and administrative actions outside of normal maintenance windows. Consider deploying a secondary endpoint detection tool to monitor the Apex One server itself.
Technical Details
CVE-2025-54948 is an OS command injection vulnerability in the Trend Micro Apex One (on-premise) management console. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H indicates a network-accessible attack requiring no authentication or user interaction, with high confidentiality and availability impact and low integrity impact. The vulnerability exists in the management console's file upload and processing functionality. A pre-authenticated remote attacker can exploit insufficient input validation to upload malicious code to the server. The uploaded code is then processed in a way that allows the attacker to inject operating system commands that execute on the underlying Windows server with the privileges of the Apex One service process. The scope is unchanged (S:U), meaning impact is confined to the Apex One server, though the strategic position of this server in the security infrastructure amplifies the real-world consequences. The integrity impact is rated low (I:L) in the CVSS vector, suggesting the command injection path involves some constraints, but the high confidentiality and availability impact confirm that the attacker achieves substantial access to the system. The affected version is Apex One 2019 (on-premise), and the patch addresses the input validation gap in the management console's upload and command processing logic.
Frequently Asked Questions
Is CVE-2025-54948 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-54948 to the Known Exploited Vulnerabilities catalog. The EPSS score of 20.46% at the 95th percentile indicates very high exploitation activity. The pre-authentication nature of the vulnerability and the strategic value of endpoint security consoles make this a high-priority target.
What products are affected by CVE-2025-54948?
Trend Micro Apex One 2019 (on-premise) is affected. The vulnerability is in the management console component. Cloud-based Apex One deployments should be verified separately with Trend Micro.
How do I fix CVE-2025-54948?
Apply the Trend Micro security patch from advisory KA-0020652 immediately. Restrict network access to the management console, and conduct a security audit if the console was exposed to untrusted networks while vulnerable.
How severe is CVE-2025-54948?
CVE-2025-54948 has a CVSS v3.1 base score of 9.4 (Critical severity). It enables unauthenticated remote code execution on the Apex One management console, which controls endpoint security across the entire organization. Compromising this platform can disable security defenses enterprise-wide.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.