Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN361

_____________________________________________________________________

DATE                : 13/06/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apex Central, Apex Central as a Service*.

=====================================================================
https://success.trendmicro.com/en-US/solution/KA-0019926
_____________________________________________________________________

CRITICAL SECURITY BULLETIN: Trend Micro Apex Central (June 2025)
Product / Version includes:

Apex Central2019 , Apex CentralAll
Last updated:   2025/06/10
Solution ID:   KA-0019926
Category:  
Summary

Release Date: June 10, 2025

CVE Identifiers: CVE-2025-49219, CVE-2025-49220

Platform: Windows

CVSS 3.1 Score(s): 9.8

Severity Rating(s): CRITICAL

 
Trend Micro has released a new Critical Patch (CP) for
Trend Micro Apex Central that resolves two critical vulnerabilities.


Important Note: although the vulnerabilities in this bulletin are rated
as critical from a technical (CVSS) perspective, it is important to
note that they have NOT been observed being actively exploited in the
wild. 


Affected Version(s)

Product	Affected Version(s) 	Platform 	Language(s) 
Apex Central	2019 (On-prem)	Windows	English
Apex Central as a Service* 	SaaS	Windows	English


Solution

Trend Micro has released the following solutions to address the issue:

Product    Updated version   Notes  Platform    Availability 

Apex Central (on-prem) 	CP B7007    Download Center   Windows  
Now Available

Apex Central as a Service*    April 2025 Monthly Release   
Windows	Now Available


*Apex Central as a Service details have been included strictly for
historical informational purposes, since the issues were addressed
in the backend during the April 2025 monthly maintenance cycle.

 
These are the minimum recommended version(s) of the patches and/or
builds required to address the issue. Trend Micro highly encourages
customers to obtain the latest version of the product if there is a
newer one available than the one listed in this bulletin.

Customers are encouraged to visit Trend Micro’s Download Center to
obtain prerequisite software (such as Service Packs) before applying
any of the solutions above.


Vulnerability Details

CVE-2025-49219:  Deserialization of Untrusted Data RCE Vulnerability 
ZDI-CAN-25286
CVSSv3: 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-477: Use of Obsolete Function

An insecure deserialization operation in Trend Micro Apex Central could
lead to a pre-authentication remote code execution on affected
installations. Note that this vulnerability is similar to CVE-2025-49220
but is in a different method.
 

CVE-2025-49220:  Deserialization of Untrusted Data RCE Vulnerability 
ZDI-CAN-25495
CVSSv3: 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-477: Use of Obsolete Function

An insecure deserialization operation in Trend Micro Apex Central could
lead to a pre-authentication remote code execution on affected
installations. Note that this vulnerability is similar to
CVE-2025-49219 but is in a different method.

Mitigating Factors

Exploiting these type of vulnerabilities generally require that an
attacker has access (physical or remote) to a vulnerable machine. In
addition to timely application of patches and updated solutions,
customers are also advised to review remote access to critical
systems and ensure policies and perimeter security is up-to-date.

However, even though an exploit may require several specific
conditions to be met, Trend Micro strongly encourages customers to
update to the latest builds as soon as possible.

In addition, due to the seriousness of these issues, Trend Micro
also released some Network IPS rules/filters for proactive secondary
protection:

TippingPoint and Trend Micro Cloud One - Network Security:
Filter 35498

Trend Micro Cloud One - Workload Security and Deep Security:
Rule 1012375
 

Acknowledgement

Trend Micro would like to thank the following individuals for
responsibly disclosing these issues and working with Trend Micro
to help protect our customers:

    Anonymous working with Trend Micro's Zero Day Initiative
(CVE-2025-49219)
    Piotr Bazydlo (@chudypb) of Trend Micro's Zero Day
Initiative (CVE-2025-49220)


External Reference(s)
The following advisories may be found at Trend Micro's Zero Day
Initiative Published Advisories site:

    ZDI-CAN-25286
    ZDI-CAN-25495




=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================