ZDI-CAN-28001: ZDI-26-136: Trend Micro Apex One Console Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Apex One console, which listens on TCP ports 8080 and 4343 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of IUSR.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-71210.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trend Micro Apex One (Console)to a version that resolves this vulnerability.Patch ZDI-26-136 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-71210 - Compensating control
Restrict network access to Trend Micro Apex One Console TCP ports 8080 and 4343 (default) to only trusted sources (e.g., management IPs) via firewall/ACL.
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-28001?
ZDI-CAN-28001 is considered a critical vulnerability due to its ability to allow remote code execution without authentication.
How do I fix ZDI-CAN-28001?
To fix ZDI-CAN-28001, update to the latest version of Trend Micro Apex One where the vulnerability is patched.
Who is affected by ZDI-CAN-28001?
ZDI-CAN-28001 affects all installations of Trend Micro Apex One that have not applied the necessary security updates.
Can ZDI-CAN-28001 be exploited remotely?
Yes, ZDI-CAN-28001 can be exploited remotely, allowing attackers to execute arbitrary code on the affected system.
Is authentication required to exploit ZDI-CAN-28001?
No, authentication is not required to exploit ZDI-CAN-28001, making it more dangerous.