CVE-2025-49155 - Vulnerability Details - OpenCVE

An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Trendmicro	Apexone Op Apexone Saas

No data.

No data.

References

Link	Providers
https://success.trendmicro.com/en-US/solution/KA-0019917
https://www.zerodayinitiative.com/advisories/ZDI-25-362/

History

Tue, 17 Jun 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 17 Jun 2025 19:00:00 +0000

Type	Values Removed	Values Added
Description		An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.
First Time appeared		Trendmicro Trendmicro apexone Op Trendmicro apexone Saas
Weaknesses		CWE-427
CPEs		cpe:2.3:a:trendmicro:apexone_op:14.0.0.14002:p3:::::: cpe:2.3:a:trendmicro:apexone_saas:14.0.0.14492:ga::::::
Vendors & Products		Trendmicro Trendmicro apexone Op Trendmicro apexone Saas
References		https://success.trendmicro.com/en-US/solution/KA-0019917 https://www.zerodayinitiative.com/advisories/ZDI-25-362/
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: trendmicro

Published: 2025-06-17T18:42:31.517Z

Updated: 2025-06-17T20:22:40.129Z

Reserved: 2025-06-02T17:43:08.724Z

Link: CVE-2025-49155

Vulnrichment

Updated: 2025-06-17T20:22:34.788Z

NVD

Status : Awaiting Analysis

Published: 2025-06-17T19:15:33.130

Modified: 2025-06-17T20:50:23.507

Link: CVE-2025-49155

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-49155", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "state": "PUBLISHED", "assignerShortName": "trendmicro", "dateReserved": "2025-06-02T17:43:08.724Z", "datePublished": "2025-06-17T18:42:31.517Z", "dateUpdated": "2025-06-17T20:22:40.129Z"}, "containers": {"cna": {"affected": [{"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One", "versions": [{"version": "2019 (14.0)", "status": "affected", "versionType": "semver", "lessThan": "14.0.0.14002"}], "cpes": ["cpe:2.3:a:trendmicro:apexone_op:14.0.0.14002:p3:*:*:*:*:*:*"]}, {"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One as a Service", "versions": [{"version": "SaaS", "status": "affected", "versionType": "semver", "lessThan": "14.0.14492"}], "cpes": ["cpe:2.3:a:trendmicro:apexone_saas:14.0.0.14492:ga:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations."}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2025-06-17T18:42:31.517Z"}, "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "problemTypes": [{"descriptions": [{"description": "CWE-427: Uncontrolled Search Path Element", "lang": "en-US", "type": "CWE", "cweId": "CWE-427"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-17T20:22:23.426414Z", "id": "CVE-2025-49155", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T20:22:40.129Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-49155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-17T20:22:23.426414Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T20:22:34.788Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:trendmicro:apexone_op:14.0.0.14002:p3:*:*:*:*:*:*"], "vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One", "versions": [{"status": "affected", "version": "2019 (14.0)", "lessThan": "14.0.0.14002", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:trendmicro:apexone_saas:14.0.0.14492:ga:*:*:*:*:*:*"], "vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex One as a Service", "versions": [{"status": "affected", "version": "SaaS", "lessThan": "14.0.14492", "versionType": "semver"}]}], "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0019917"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-362/"}], "descriptions": [{"lang": "en", "value": "An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2025-06-17T18:42:31.517Z"}}}, "cveMetadata": {"cveId": "CVE-2025-49155", "state": "PUBLISHED", "dateUpdated": "2025-06-17T20:22:40.129Z", "dateReserved": "2025-06-02T17:43:08.724Z", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "datePublished": "2025-06-17T18:42:31.517Z", "assignerShortName": "trendmicro"}, "dataVersion": "5.1"}