CVE-2023-0587: Trend Micro Apex One unauthenticated arbitrary file upload via malformed Content-Length

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable file upload with high availability impact and a very high EPSS score, though KEV listing and confirmed code execution are absent.

What it is

Trend Micro Apex One server build 11110 contains an unrestricted file upload flaw (CWE-434). An unauthenticated remote attacker can send an HTTP PUT with a malformed Content-Length header to /officescan/console/html/cgi/fcgiOfcDDA.exe and write arbitrary files into the SampleSubmission directory. The record does not state whether the uploaded files can be executed, so the confirmed effect is file system abuse rather than code execution.

Impact

An attacker can upload a large number of large files to fill the file system hosting the Apex One server, causing a denial of service. Because the upload is unrestricted, arbitrary file placement in the SampleSubmission directory is also possible, though the record does not confirm execution of those files.

Attack surface

Reachable over the network via HTTP PUT to the Apex One management server URL /officescan/console/html/cgi/fcgiOfcDDA.exe. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and description both indicate no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.59585, 99th percentile), and the only reference is Tenable's research advisory with no exploit tags, so public exploit code is not confirmed by this record.

What to do

• Apply the Trend Micro fix for Apex One build 11110 or later as directed by the vendor advisory; patching is the primary action.
• Restrict network access to the Apex One server console and the /officescan/console/html/cgi/ path to trusted management networks only.
• Monitor and cap free space on the volume holding \PCCSRV\TEMP\SampleSubmission and alert on abnormal growth.
• If patching is delayed, block or filter HTTP PUT requests with malformed or oversized Content-Length headers at the perimeter or reverse proxy.

Detection

• Alert on HTTP PUT requests to /officescan/console/html/cgi/fcgiOfcDDA.exe, especially from unexpected source IPs.
• Monitor file creation and growth in \PCCSRV\TEMP\SampleSubmission for unusual volume or file sizes.
• Track disk usage trends on the Apex One server volume and alert on rapid consumption.
• Review web server logs for malformed or mismatched Content-Length headers on PUT requests to the Apex One console.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.