CVE-2025-71210

Katalog CVE

CVSS 9.8 · Critical EPSS 3,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada trendmicro apex one. Skor CVSS 3.1 9.8 (Critical) menurut trendmicro.com.

Deskripsi (NVD)

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

Rincian

Terbit di NVD

21 Mei 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber trendmicro.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

3,8% peluang dieksploitasi; lebih tinggi dari 89,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://success.trendmicro.com/en-US/solution/KA-0022458 advisory vendor
• https://www.zerodayinitiative.com/advisories/ZDI-26-136/ advisory pihak ketiga