JVNDB-2025-010854

Trend Micro Endpoint security products for enterprises vulnerable to multiple OS command injection

Trend Micro Endpoint security products for enterprises contain the following vulnerabilities.

• OS command injection vulnerability in the management console (CWE-78) - CVE-2025-54948, CVE-2025-54987

Trend Micro Incorporated has reported that attacks exploiting CVE-2025-54948 have been observed in the wild.

Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.

Trend Micro, Inc.

• Trend Micro Apex One On Premise (2019)
• Trend Micro Apex One as a Service
• Trend Vision One Endpoint Security - Standard Endpoint Protection

An unauthenticated attacker may exploit this vulnerability to execute arbitrary code.

For Trend Micro Apex One On Premise (2019):
[Apply the Patch]
Apply the patch according to the information provided by the developer.
The developer has released the patch listed below that contains a fix for the vulnerabilities.

* Trend Micro Apex One On Premise (2019) SP1 CP B14081

For Trend Micro Apex One as a Service and Trend Vision One Endpoint Security - Standard Endpoint Protection:
The vulnerabilities have already been fixed in the July 31, 2025 updates.

Trend Micro, Inc.

• Trend Micro Incorporated : ITW CRITICAL SECURITY BULLETIN: Trend Micro Apex One (On-Premise) Management Console Command Injection RCE Vulnerabilities
• Trend Micro Incorporated : [Important Notice] Respond to Confirmed Attacks Exploiting Vulnerabilities in Trend Micro Endpoint Security Products (in Japanese)

1. OS Command Injection(CWE-78) [Other]

1. CVE-2025-54948
2. CVE-2025-54987

1. JVN : JVNVU#92409854
2. JPCERT Alert : JPCERT-AT-2025-0016

• [2025/08/07]
    Web page was published
• [2025/08/19]
    Solution was modified