CVE-2023-52324 is an unrestricted file upload flaw in Trend Micro Apex Central 2019 on premises builds before 6570. NVD scores it high at 8.8, while Trend Micro and ZDI score it 6.5. It needs valid credentials. Apply Patch 8 r2 (build 6660) or later.
What's affected
The NVD record lists Trend Micro Apex Central 2019. Trend Micro's bulletin of 9 January 2024 gives more detail: the affected product is Apex Central 2019, on premises builds before 6570, on Windows. The fix is Patch 8 r2 (build 6660, repacked), and the bulletin says it is available now. The bulletin is shared with several other Apex Central CVEs from the same release.
The record's weakness is CWE-434, unrestricted upload of a file with a dangerous type, and its vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which gives 8.8 (High).
The severity differs between sources. Trend Micro's bulletin and the Zero Day Initiative advisory ZDI-24-077 both give 6.5 with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, which rates only integrity impact. NVD rates confidentiality and availability as high too. Both ratings are published, and I use the NVD score for the title as the brief asks. The ZDI text says the flaw is in the processing of uploaded ZIP files and can be combined with other vulnerabilities to run code as IUSR.
How to check if you're exposed
Apex Central is installed on Windows. The simplest check is the build number shown in the product's console and in the installed programs list on the server, which you compare against the bulletin: builds before 6570 are listed as affected, and the bulletin names build 6660 as the fixed one.
I did not find an exact menu path in the sources, so follow Trend Micro's readme for Patch 8 r2 for the supported way to confirm the build. Note also that the bulletin tells customers to use the newest patch available, since some of the listed CVEs may have been fixed earlier.
Beyond the version, check who can sign in to the console. Every Apex Central issue in this group needs a valid account or chains with another flaw, so the account list and the network path to the console are part of your exposure.
What to do now
- Identify every Apex Central server and its build number.
- Apply Patch 8 r2 (build 6660) or the newest patch Trend Micro offers, following the readme and the prerequisites in the bulletin.
- Limit network access to the management console to administrator networks, and review remote access to the server, as the bulletin advises.
- Review the console accounts. Remove accounts that are unused and make sure the remaining ones use strong, unique credentials.
- Record the patch in your change log so an audit can see when it was applied.
Why it matters
An unrestricted upload means the product accepts a file without sufficiently checking what it is or where it ends up. The record says an authenticated attacker can create arbitrary files on the installation, and notes that any valid set of credentials is enough. It also says the flaw could be used with another vulnerability to run code. On its own, the main impact is writing files to the server; the danger is in combining it with something else.
That chaining is why management consoles deserve fast patching even when each bug needs a login. Administration servers for security products hold wide reach over the endpoints they manage. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you keep track of the components you run and the advisories that apply to them.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the scores for CVE-2023-52324 differ?
NVD gives 8.8 and rates confidentiality, integrity and availability high. Trend Micro and ZDI give 6.5 and rate only integrity. Both are published. In either case the fix is the same patch.
Can anyone exploit CVE-2023-52324 without an account?
No. The record says authentication is required, but any valid set of credentials is enough, so a low privilege account counts.
Sources
- Trend Micro security bulletin for Apex Central, 9 January 2024
- Zero Day Initiative advisory ZDI-24-077
- Gold page for CVE-2023-52324
Last reviewed: 19 October 2026.
