Paper/Archive/CVE-2025-12480

CVE-2025-12480

TrioFox TrioFox — Gladinet Triofox Improper Access Control Vulnerability

KEV · due 3 Dec EPSS 96%public exploit SSVC act CVSS 9.1

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 In CISA KEV+3030.0 EPSS percentile 99.9.999 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

Affected

ProductAffectedFixed inSource

TrioFox< 16.7.10368.5656016.7.10368.56560CNA

Scores by source

Mandiant (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

writeupgithub.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0008.md reftriofox.com refaccess.triofox.com/releases_history writeupcloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-12480 kevcisa.gov/known-exploited-vulnerabilities-catalog