This vulnerability (CVE-2025-54948) affects Trend Micro Apex One (on-premise) management console version 2019 (14.0). It is an OS command injection flaw (CWE-78) that enables a pre-authenticated remote attacker to upload and execute arbitrary code on the affected system. The CVSS v3.1 score of 9.4 reflects network attack vector, no privileges required, no user interaction, and high impact on confidentiality and availability. The vulnerability was published on August 5, 2025, and is currently in a published state with no vendor-provided patch or mitigation details available. The product is not a cloud service, so remediation depends on vendor updates or user-applied fixes.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the management console server, potentially leading to full system compromise. This impacts confidentiality (high), integrity (low), and availability (high) of the affected system. Given the management console's role, this could severely disrupt endpoint security management and expose sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Trend Micro's advisories closely and consider restricting network access to the management console until a fix is available. Avoid exposing the management console to untrusted networks. Do not assume the vulnerability is mitigated without vendor confirmation.