{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-47867", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "state": "PUBLISHED", "assignerShortName": "trendmicro", "dateReserved": "2025-05-12T16:13:08.568Z", "datePublished": "2025-06-17T17:42:55.846Z", "dateUpdated": "2025-06-18T03:56:08.682Z"}, "containers": {"cna": {"affected": [{"vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex Central", "versions": [{"version": "8.0", "status": "affected", "versionType": "semver", "lessThan": "8.0.6955"}], "cpes": ["cpe:2.3:a:trendmicro:apex_central:6955:*:*:en:*:windows_10:x86_64:1809"]}], "descriptions": [{"lang": "en", "value": "A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations."}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2025-06-17T17:42:55.846Z"}, "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0019355"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-297/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "problemTypes": [{"descriptions": [{"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component", "lang": "en-US", "type": "CWE", "cweId": "CWE-74"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-17T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-47867"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-18T03:56:08.682Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-47867", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-17T18:30:10.263426Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-17T18:30:11.320Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:trendmicro:apex_central:6955:*:*:en:*:windows_10:x86_64:1809"], "vendor": "Trend Micro, Inc.", "product": "Trend Micro Apex Central", "versions": [{"status": "affected", "version": "8.0", "lessThan": "8.0.6955", "versionType": "semver"}]}], "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0019355"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-297/"}], "descriptions": [{"lang": "en", "value": "A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component"}]}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2025-06-17T17:42:55.846Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47867", "state": "PUBLISHED", "dateUpdated": "2025-06-18T03:56:08.682Z", "dateReserved": "2025-05-12T16:13:08.568Z", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "datePublished": "2025-06-17T17:42:55.846Z", "assignerShortName": "trendmicro"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:-:*:*:-:*:*:*", "matchCriteriaId": "664A5F5B-7494-4ADF-9028-CA5DC84AF91A", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_3752:*:*:-:*:*:*", "matchCriteriaId": "316E50F7-A9DA-4B67-9ECC-C8D50116BA07", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_5158:*:*:-:*:*:*", "matchCriteriaId": "8FBF6D0D-D68E-4DB2-B4DE-D4157FEE54F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_6016:*:*:-:*:*:*", "matchCriteriaId": "4B11EE47-757F-4A7D-806A-01C956535F4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_6288:*:*:-:*:*:*", "matchCriteriaId": "FB8D4938-783C-4954-95C0-BD26162330A6", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_6394:*:*:-:*:*:*", "matchCriteriaId": "8FFFED78-5927-4529-B74C-BF988108EC0C", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_6481:*:*:-:*:*:*", "matchCriteriaId": "D919B553-6CBD-4211-A507-CD930D485852", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_6511:*:*:-:*:*:*", "matchCriteriaId": "F30EC7A8-6E0D-40CE-9691-90F438F1F03B", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_6571:*:*:-:*:*:*", "matchCriteriaId": "F905E86D-E3D9-4E54-B2A6-01753043A9F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_6658:*:*:-:*:*:*", "matchCriteriaId": "231493F7-3804-4123-BE1E-ABC3AC46DAAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_6660:*:*:-:*:*:*", "matchCriteriaId": "983C3666-DF36-4C30-BD70-669734D28475", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:apex_central:2019:build_6890:*:*:-:*:*:*", "matchCriteriaId": "2EFB9449-DB07-4F75-AB53-23F2B721C0CE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations."}, {"lang": "es", "value": "Una vulnerabilidad de inclusi\u00f3n de archivos locales en un widget de Trend Micro Apex Central en versiones anteriores a 8.0.6955 podr\u00eda permitir que un atacante incluya archivos arbitrarios para ejecutarlos como c\u00f3digo PHP y provocar la ejecuci\u00f3n remota de c\u00f3digo en las instalaciones afectadas."}], "id": "CVE-2025-47867", "lastModified": "2025-09-08T21:04:50.527", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@trendmicro.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-06-17T18:15:26.703", "references": [{"source": "security@trendmicro.com", "tags": ["Vendor Advisory"], "url": "https://success.trendmicro.com/en-US/solution/KA-0019355"}, {"source": "security@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-297/"}], "sourceIdentifier": "security@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "security@trendmicro.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}