← Vulnerability feed

Vulnerability record · CVE-2023-52324 · published 23 January 2024

CVE-2023-52324: Trendmicro apex central unrestricted file upload vulnerability

Trendmicro · Apex Central

An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations. Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials. Also, this vulnerability could be potentially used in combination with another vulnerability to execute arbitrary code.

8.8 CVSS 3.1 High EPSS 4.2% · top 9.5% CWE-434 · Unrestricted file upload
8.8CVSS 3.1 base score
4.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected installations. Please note: although authentication is required to exploit this vulnerability, this vulnerability could be exploited when the attacker has any valid set of credentials. Also, this vulnerability could be potentially used in combination with another vulnerability to execute arbitrary code.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-077/ Third Party AdvisoryVDB Entry
https://success.trendmicro.com/dcx/s/solution/000296153?language=en_US Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-077/ Third Party AdvisoryVDB Entry

Track CVE-2023-52324 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-26871Trend Micro Apex Central unauthenticated arbitrary file uploadTrend Micro Apex Central (and Apex One) contains an arbitrary file upload flaw caused by insufficient verification of data authenticity (CWE-345). An…KEVEPSS 19%analysed9.8CVE-2025-69258Trendmicro apex central classic buffer overflow vulnerabilityA LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a ke…EPSS 3.6%9.8CVE-2025-49220Trendmicro apex central deserialization of untrusted data vulnerabilityAn insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on …EPSS 2.1%9.8CVE-2025-47865Trendmicro apex central vulnerabilityA Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code executio…EPSS 1.8%9.8CVE-2025-47867Trendmicro apex central injection vulnerabilityA Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary fil…EPSS 1.9%9.8CVE-2025-49219Trendmicro apex central deserialization of untrusted data vulnerabilityAn insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on…EPSS 1.4%8.8CVE-2023-32529Trendmicro apex central sql injection vulnerabilityVulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection …EPSS 2.2%8.8CVE-2023-32530Trendmicro apex central sql injection vulnerabilityVulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection …EPSS 2.4%

Source: NIST National Vulnerability Database (record CVE-2023-52324), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.