CVE-2023-52325
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 4.5%
exploitation probability
4.5%top 9% of all CVEs
observed exploitation
nono source reports it
In short
A flaw in Trend Micro Apex Central's widgets allows an attacker with valid login credentials to include and execute arbitrary code on the server. This requires combining with another vulnerability and authentication access to work.
Technical detail
Local file inclusion (LFI) vulnerability in Apex Central widget processing enables arbitrary code execution via path traversal or file parameter manipulation. Exploitation requires valid system credentials and chaining with an additional vulnerability; the attack vector is network-based but authentication-gated, resulting in complete system compromise.
Summary generated and translated by AI from the official description.
A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations.
Please note: this vulnerability must be used in conjunction with another one to exploit an affected system. In addition, an attacker must first obtain a valid set of credentials on target system in order to exploit this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Trend Micro, Inc. · Trend Micro Apex Central