CVE-2025-49220: Trend Micro Apex Central ConvertFromJson Deserialization of Untrusted Data Remote Code Execution Vulnerability
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex Central. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the ConvertFromJson method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49220?
CVE-2025-49220 is rated as critical due to its potential for pre-authentication remote code execution.
How do I fix CVE-2025-49220?
To remediate CVE-2025-49220, update Trend Micro Apex Central to version 8.0.7007 or later.
What products are affected by CVE-2025-49220?
CVE-2025-49220 affects Trend Micro Apex Central versions below 8.0.7007.
What type of vulnerability is CVE-2025-49220?
CVE-2025-49220 is classified as an insecure deserialization vulnerability.
Can CVE-2025-49220 be exploited without authentication?
Yes, CVE-2025-49220 can be exploited without authentication, allowing attackers to execute code remotely.