by Kastro
Paper/Archive/CVE-2025-14611

CVE-2025-14611

Gladinet CentreStack and TrioFox — Gladinet CentreStack and TrioFox Hard Coded AES Keys

KEV · due 5 JanEPSS 53%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (NVD)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.0.990 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.

Affected

ProductAffectedFixed inSource
CentreStack and TrioFox< 16.12.10420.5679116.12.10420.56791CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Huntress (CNA)7.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refhuntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerabilityrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14611kevcisa.gov/known-exploited-vulnerabilities-catalog