CVE-2023-52325: high-severity vulnerability in Trend Micro Apex Central
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in Trend Micro Apex Central's widgets allows an attacker with valid login credentials to include and execute arbitrary code on the server. This requires combining with another vulnerability and authentication access to work.
Local file inclusion (LFI) vulnerability in Apex Central widget processing enables arbitrary code execution via path traversal or file parameter manipulation. Exploitation requires valid system credentials and chaining with an additional vulnerability; the attack vector is network-based but authentication-gated, resulting in complete system compromise.
In the same product, most dangerous first.