Full Report
Trend Micro has released security updates to address multiple critical-severity remote code execution and authentication bypass vulnerabilities that impact its Apex Central and Endpoint Encryption (TMEE) PolicyServer products. [...]
Analysis Summary
# Vulnerability: Critical Pre-Authentication RCE Flaws in Trend Micro Apex Central
## CVE Details
- CVE ID: CVE-2025-49219, CVE-2025-49220
- CVSS Score: 9.8 (Critical)
- CWE: (Insecure Deserialization implicitly for both, stated for CVE-2025-49219 and CVE-2025-49220)
## Affected Systems
- Products: Trend Micro Apex Central (On-Premise)
- Versions: All versions prior to Patch B7007 for Apex Central 2019
- Configurations: On-premise installations. Apex Central as a Service receives automatic backend patches.
## Vulnerability Description
Two critical, pre-authentication Remote Code Execution (RCE) vulnerabilities exist in Trend Micro Apex Central due to insecure deserialization.
1. **CVE-2025-49219:** Affects the `GetReportDetailView` method. Insecure deserialization allows an unauthenticated attacker to execute arbitrary code in the context of the `NETWORK SERVICE` account.
2. **CVE-2025-49220:** Affects the `ConvertFromJson` method. Improper input validation during deserialization allows unauthenticated attackers to execute arbitrary code remotely.
## Exploitation
- Status: Unknown/Not specified as exploited in the wild, but described as critical pre-authentication RCEs.
- Complexity: Low (Implied by "pre-authentication" and high CVSS score)
- Attack Vector: Network
## Impact
- Confidentiality: High (Code execution context potentially leads to data access)
- Integrity: High (Arbitrary code execution)
- Availability: High (Arbitrary code execution)
## Remediation
### Patches
- **CVE-2025-49219 & CVE-2025-49220:** Patch B7007 for Trend Micro Apex Central 2019 (on premise).
- Apex Central as a Service: Patches are applied automatically on the backend.
### Workarounds
- No specific mitigations or workarounds were listed for these two specific CVEs.
## Detection
- Detection details were not explicitly provided in this summary snippet (e.g., specific IOCs).
- Mitigation relies solely on applying the vendor-supplied patches.
## References
- Vendor Advisory (Apex Central RCEs): success[.]trendmicro[.]com/en-US/solution/KA-0019926
- ZDI Reference (CVE-2025-49219): zerodayinitiative[.]com/advisories/ZDI-25-366/
- ZDI Reference (CVE-2025-49220): zerodayinitiative[.]com/advisories/ZDI-25-367/