CVE-2025-14611

What it actually does

The vulnerability is a cryptographic design failure in Gladinet CentreStack and Triofox versions prior to 16.12.10420.56791. The products used hardcoded AES cryptographic values, meaning an attacker can potentially predict or reproduce protected request data instead of needing a unique secret. For internet-exposed endpoints that rely on this cryptographic scheme, a specially crafted unauthenticated request may trigger arbitrary local file inclusion, allowing the attacker to read files from the server. In combination with other CentreStack or Triofox weaknesses, leaked local files such as configuration data, application secrets, keys, or credentials can support privilege escalation and full system compromise.

Why it matters to the business

A vulnerable CentreStack or Triofox deployment can expose sensitive files without requiring a login. Because these products often broker access to enterprise file-sharing data, exploitation can lead to credential theft, disclosure of internal configuration, loss of confidentiality for business files, and follow-on compromise of the hosting server. The issue is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2026-01-05, so organizations should treat exposed systems as high priority even though the issue is not currently marked as ransomware-associated. The EPSS score is high enough to indicate meaningful exploitation likelihood, and the 9.8 CVSS rating reflects the potential for unauthenticated compromise.

How an attack unfolds

An attacker first identifies an internet-facing Gladinet CentreStack or Triofox instance running a version earlier than 16.12.10420.56791. Because the affected cryptographic implementation uses hardcoded AES values, the attacker can craft request data that the application may accept as valid without authenticating. The attacker then sends a specially formed request to a public endpoint that exercises the vulnerable cryptographic path and attempts to include or retrieve local files from the server. Initial targets are typically low-risk proof files or operating-system markers, followed by application configuration files, secrets, encryption material, service credentials, or other files useful for lateral movement. If sensitive configuration or credentials are obtained, the attacker may combine this access with earlier or separate product vulnerabilities to gain administrative access, deploy tooling, create persistence, or compromise the underlying host. Active exploitation has been reported under the Gladinet CentreStack and Triofox hard-coded cryptographic vulnerability activity label.

How to fix it

Upgrade Gladinet CentreStack and Triofox to version 16.12.10420.56791 or later. If immediate upgrade is not possible, restrict public access to the application through VPN, zero-trust access controls, IP allowlisting, or a reverse proxy with strict authentication; however, network restriction should be treated only as a temporary mitigation. Block unauthenticated requests containing path traversal patterns or attempts to read local operating-system and application configuration files. Rotate potentially exposed secrets after patching, including application keys, service-account credentials, database credentials, API keys, and any credentials stored in local configuration files. Review vendor advisories for any additional hardening or companion fixes, especially because the issue can be chained with previous vulnerabilities for full compromise.

How to confirm the fix worked

Confirm the installed CentreStack or Triofox version is 16.12.10420.56791 or later through the product administration interface, installed package metadata, or vendor-supported version checks. Verify that all internet-facing nodes, load-balanced servers, standby systems, and disaster-recovery images have been upgraded. From an unauthenticated network position, confirm that public endpoints no longer return local file contents when presented with traversal-like or malformed encrypted request data. Review web server and application logs before and after remediation to ensure suspicious unauthenticated file-access attempts are blocked. Where feasible, use vulnerability scanning or an external attack-surface management tool to verify that no exposed instance remains on a vulnerable version.

Typical attack path

1. Scan the internet or known asset ranges for exposed Gladinet CentreStack or Triofox portals.
2. Fingerprint the application and infer whether it is running a version prior to 16.12.10420.56791.
3. Send unauthenticated crafted requests that abuse the hardcoded AES implementation.
4. Attempt local file inclusion using traversal or absolute-path file references.
5. Read benign proof files first, then target configuration files, credentials, keys, logs, or application secrets.
6. Use disclosed secrets or credentials to access privileged application functions or the host operating system.
7. Chain the file disclosure with other known CentreStack or Triofox vulnerabilities to achieve broader compromise.
8. Establish persistence, exfiltrate data, or move laterally if higher-value credentials are obtained.

How to detect it

Investigate web server, reverse-proxy, WAF, EDR, and application logs for unauthenticated requests to CentreStack or Triofox endpoints that include path traversal sequences, encoded traversal, absolute Windows or Linux file paths, or attempts to read configuration files. Pay particular attention to requests that return HTTP 200 responses with unusually large response sizes, requests without a valid authenticated session, and repeated probes for operating-system marker files such as win.ini, hosts, or passwd. On Windows hosts, review IIS logs, application logs, Windows Security events, PowerShell logs, and EDR telemetry for the application worker process reading files outside expected application directories or spawning shells, scripting interpreters, archive utilities, or network tools. Look for access to configuration files followed by suspicious logins, creation of new admin users, service creation, scheduled tasks, credential dumping behavior, or outbound connections to unfamiliar infrastructure. Because this vulnerability is known exploited in the wild, preserve logs and forensic artifacts before patching where possible, and treat any confirmed file-read event involving secrets as a credential-compromise incident.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• %252e%252e%255c
• /etc/passwd
• /etc/hosts
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• web.config
• appsettings.json
• connectionStrings
• machineKey
• Gladinet CentreStack
• Triofox
• 16.12.10420.56791

What your security team should do

• Patch all Gladinet CentreStack and Triofox systems to 16.12.10420.56791 or later before the CISA KEV due date of 2026-01-05; prioritize internet-facing systems first.
• Assume exposed vulnerable systems may have been probed or exploited and perform log review for unauthenticated local file inclusion attempts.
• Temporarily restrict external access to vulnerable portals until patching and validation are complete.
• Rotate secrets that may be stored on the application server, especially configuration-file credentials, service accounts, API tokens, and encryption keys.
• Search for signs of post-exploitation, including new administrative users, unexpected scheduled tasks, web shells, suspicious child processes, and outbound connections from the application server.
• Add WAF or reverse-proxy rules to alert on traversal patterns and requests for sensitive local files, but do not rely on filtering as a replacement for the vendor fix.
• Monitor vendor advisories and threat intelligence for exploit chaining details because this flaw can enable full compromise when combined with prior vulnerabilities.