ZDI-CAN-28002: ZDI-26-137: Trend Micro Apex One Console Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Apex One console, which listens on TCP ports 8080 and 4343 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of IUSR.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-71211.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trend Micro Apex Oneto a version that resolves this vulnerability.Patch ZDI-26-137 - Compensating control
Restrict network access to the Trend Micro Apex One Console service listening on TCP ports 8080 and 4343 (e.g., limit inbound access to trusted IPs at the firewall/ACL) until patched.
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-28002?
The severity of ZDI-CAN-28002 is critical due to its ability to allow remote code execution without authentication.
How do I fix ZDI-CAN-28002?
To fix ZDI-CAN-28002, upgrade your Trend Micro Apex One installation to the latest patched version provided by Trend Micro.
Who is affected by ZDI-CAN-28002?
ZDI-CAN-28002 affects all installations of Trend Micro Apex One that have not been updated with the security patch.
Can ZDI-CAN-28002 be exploited remotely?
Yes, ZDI-CAN-28002 can be exploited remotely as it does not require authentication for execution.
What type of vulnerability is ZDI-CAN-28002?
ZDI-CAN-28002 is classified as a directory traversal vulnerability that enables remote code execution.