CVE-2025-30678: Trend Micro Apex Central SSRF Vulnerability

CVE-2025-30678 Overview

CVE-2025-30678 is a Server-Side Request Forgery (SSRF) vulnerability affecting Trend Micro Apex Central (on-premise) installations. The flaw resides in the modTMSM component and stems from improper validation of user-supplied parameters. Attackers can manipulate these parameters to coerce the Apex Central server into issuing arbitrary outbound requests, resulting in information disclosure from the affected installation or adjacent internal resources.

The vulnerability is categorized under CWE-918: Server-Side Request Forgery. It requires no authentication and no user interaction, making remote network exploitation straightforward against exposed management consoles.

Critical Impact
Unauthenticated remote attackers can abuse the modTMSM component to perform SSRF attacks, leading to disclosure of sensitive information from the Apex Central host and reachable internal services.

Affected Products

Trend Micro Apex Central 2019 (on-premise), multiple builds including build_3752 through build_6890
Trend Micro Apex Central deployments running on Microsoft Windows
On-premise installations exposing the modTMSM component

Discovery Timeline

2025-06-17 - CVE-2025-30678 published to NVD
2025-09-08 - Last updated in NVD database
Coordinated through the Zero Day Initiative Advisory ZDI-25-236

Technical Details for CVE-2025-30678

Vulnerability Analysis

Apex Central is Trend Micro's centralized security management console used to orchestrate policy, identifications, and reporting across endpoint and gateway products. The modTMSM component exposes server-side functionality that accepts client-controlled parameters used to construct outbound HTTP requests. The component fails to enforce a strict allow list or destination validation on these parameters.

An unauthenticated attacker with network access to the management interface can submit crafted parameter values. The server then issues HTTP requests on the attacker's behalf to arbitrary destinations. Response data or behavioral side effects are exposed back to the attacker, enabling reconnaissance of internal networks and disclosure of sensitive content reachable from the Apex Central host.

Root Cause

The root cause is missing or insufficient validation of URL or host parameters consumed by modTMSM before they are passed to an outbound HTTP client. Without destination filtering, the server treats attacker-controlled input as a trusted target, satisfying the conditions of [CWE-918].

Attack Vector

Exploitation occurs over the network against the Apex Central web interface. No credentials or user interaction are required. An attacker sends a crafted request to the vulnerable modTMSM endpoint with manipulated parameters that point at an internal host, cloud metadata service, or sensitive file resource. The server fetches the target and returns information observable to the attacker.

Verified exploitation code is not currently public. Refer to the Zero Day Initiative Advisory ZDI-25-236 for additional technical context.

Detection Methods for CVE-2025-30678

Indicators of Compromise

Outbound HTTP or HTTPS connections originating from the Apex Central server to unexpected internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
Unusual request patterns to modTMSM endpoints containing URL-like parameter values, IP addresses, or schemes such as file://, http://, or gopher://.
Apex Central IIS or web server logs showing repeated requests with manipulated parameters from a single external source.

Detection Strategies

Inspect web access logs for requests targeting modTMSM handlers with parameters containing fully qualified URLs or private IP ranges.
Correlate inbound requests to Apex Central with subsequent unexpected outbound connections from the host to identify SSRF chains.
Deploy network monitoring rules that flag any Apex Central server traffic destined for internal management subnets it does not normally communicate with.

Monitoring Recommendations

Forward Apex Central web server, application, and Windows event logs to a centralized analytics platform for retention and correlation.
Baseline the legitimate outbound destinations of the Apex Central server and alert on deviations.
Monitor for authentication events and configuration changes on Apex Central immediately following anomalous modTMSM requests.

How to Mitigate CVE-2025-30678

Immediate Actions Required

Apply the fixed build referenced in the Trend Micro Solution Advisory KA-0019355 to all on-premise Apex Central servers.
Restrict network access to the Apex Central management console to trusted administrative networks using firewall or host-based ACLs.
Audit recent Apex Central web logs for evidence of probing against modTMSM parameters.

Patch Information

Trend Micro has published remediation guidance in KA-0019355. Administrators should upgrade affected Apex Central 2019 installations to the patched build identified in that advisory. Coordinated disclosure was handled via the Zero Day Initiative Advisory ZDI-25-236.

Workarounds

Place the Apex Central console behind a VPN or jump host so that the management interface is unreachable from untrusted networks.
Use egress filtering on the Apex Central server to block outbound connections to internal management subnets, cloud metadata services, and the loopback range, limiting SSRF impact.
Increase log retention and review intervals for Apex Central while the patch rollout is in progress.

bash

# Example Windows Firewall rule restricting inbound access to Apex Central console
New-NetFirewallRule -DisplayName "Restrict Apex Central Console" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -RemoteAddress 10.0.0.0/24 `
  -Action Allow