CVE-2025-54987

The vulnerability is classified as command injection (CWE-78) and affects the management console of the Apex One product in the locally installed version (on-premise). An attacker, without needing any credentials (pre-authenticated), can send a crafted network request to upload malicious code to the vulnerable installation and then trigger the execution of arbitrary system commands. According to the description, the flaw is essentially identical to CVE-2025-54948, but targeted at a different processor architecture.

An attacker can gain unauthorized access to the system, execute arbitrary commands in its context, and potentially take control of the Apex One management service, which threatens the confidentiality and availability of protected resources.

Immediately apply patches available from the vendor in accordance with references published by Trend Micro at https://success.trendmicro.com/en-US/solution/KA-0020652. Until the fix is implemented, it is recommended to restrict network access to the Apex One management console to trusted IP addresses only and implement network-level firewall rules.

Trend Micro Apex One (on-premise version) – specific versions indicated in the vendor's references (https://success.trendmicro.com/en-US/solution/KA-0020652)