CVE-2023-52325 is a high severity (7.5) local file inclusion in a widget of Trend Micro Apex Central 2019, on premises builds before 6570. It needs valid credentials and another flaw to be exploited. Trend Micro fixed it in Patch 8 r2 (build 6660), so apply that patch or newer.
What's affected
The NVD record lists Trend Micro Apex Central 2019. Trend Micro's bulletin of 9 January 2024 gives more detail: the affected product is Apex Central 2019, on premises builds before 6570, on Windows. The fix is Patch 8 r2 (build 6660, repacked), and the bulletin says it is available now. The bulletin is shared with several other Apex Central CVEs from the same release.
The record's weakness is CWE-98, improper control of a file name in an include statement. The vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, which gives 7.5 (High). The high attack complexity matches the record's note that it must be used with another vulnerability.
Trend Micro's bulletin and ZDI advisory ZDI-24-024 both give the same score of 7.5, so there is no severity conflict here. The ZDI text places the flaw in the getObjWGFServiceApiByApiName function, where user supplied data reaches a PHP include call without proper validation, and says it can be chained with other vulnerabilities to run code as IUSR.
How to check if you're exposed
Apex Central is installed on Windows. The simplest check is the build number shown in the product's console and in the installed programs list on the server, which you compare against the bulletin: builds before 6570 are listed as affected, and the bulletin names build 6660 as the fixed one.
I did not find an exact menu path in the sources, so follow Trend Micro's readme for Patch 8 r2 for the supported way to confirm the build. Note also that the bulletin tells customers to use the newest patch available, since some of the listed CVEs may have been fixed earlier.
Beyond the version, check who can sign in to the console. Every Apex Central issue in this group needs a valid account or chains with another flaw, so the account list and the network path to the console are part of your exposure.
What to do now
- Identify every Apex Central server and its build number.
- Apply Patch 8 r2 (build 6660) or the newest patch Trend Micro offers, following the readme and the prerequisites in the bulletin.
- Limit network access to the management console to administrator networks, and review remote access to the server, as the bulletin advises.
- Review the console accounts. Remove accounts that are unused and make sure the remaining ones use strong, unique credentials.
- Check that no other Apex Central issue from the January 2024 bulletin remains open on any server. Record the patch in your change log so an audit can see when it was applied.
Why it matters
A file inclusion bug lets a request influence which file the server loads and runs as code. The record says it could allow remote code execution but only in conjunction with another vulnerability, and only with valid credentials. That is a lot of conditions, but they are conditions an attacker with a foothold can meet, and the same bulletin lists other Apex Central flaws from the same research.
The lesson is to treat the group as one patch. Fixing only the most severe item in a bulletin leaves the others in place for chaining. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you keep track of the components you run and the advisories that apply to them.
Quick check
Does CVE-2023-52325 give remote code execution by itself?
No. The record says it must be used with another vulnerability and that the attacker needs valid credentials. Patch it anyway, because the other flaws in the same bulletin are in the same fix.
What is the fixed build?
Trend Micro's bulletin lists Apex Central Patch 8 r2, build 6660, repacked. It lists on premises builds before 6570 as affected.
Sources
- Trend Micro security bulletin for Apex Central, 9 January 2024
- Zero Day Initiative advisory ZDI-24-024
- Gold page for CVE-2023-52325
Last reviewed: 19 October 2026.
