CVE-2025-47865
BaseFortify
Publication date: 2025-06-17
Last updated on: 2025-09-08
Assigner: Trend Micro, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| trendmicro | apex_central | 2019 |
| microsoft | windows | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo | |
| CWE-475 | The behavior of this function is undefined unless its control parameter is set to a specific value. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-47865 is a Local File Inclusion vulnerability in Trend Micro Apex Central versions below 8.0.6955. It occurs due to improper validation of user-supplied input before it is passed to a PHP include function within the getObjWGFServiceApiByApiName function. This flaw allows an authenticated attacker to include local files, which can be exploited to execute arbitrary code remotely with the privileges of the IUSR user. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with limited privileges to execute arbitrary code remotely on the affected system. This could lead to unauthorized access, data compromise, system manipulation, or disruption of services, depending on the privileges of the exploited user account. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves verifying if the affected Trend Micro Apex Central version below 8.0.6955 is in use and monitoring for suspicious activity related to the getObjWGFServiceApiByApiName function. Since exploitation requires authentication and involves local file inclusion via PHP include functions, you can check web server logs for unusual requests to this function or attempts to include unexpected files. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the update released by Trend Micro that addresses this vulnerability. Ensuring that your Apex Central installation is upgraded to version 8.0.6955 or later will remediate the issue. Additionally, restrict access to the affected service to trusted users only and monitor for any suspicious activity until the patch is applied. [1]