John Hammond

**Name of the Vulnerable Software and Affected Versions** Gladinet CentreStack and Triofox versions prior to 16.12.10420.56791 **Description** Gladinet CentreStack and Triofox utilize hardcoded values in their AES cryptoscheme implementation. This weakens security, particularly for publicly exposed endpoints, and allows for arbitrary local file inclusion through specially crafted, unauthenticated requests. Exploitation of this issue can potentially lead to a full system compromise, especially when combined with other existing weaknesses. The vulnerability resides in the `UploadDownloadProxy` component's `filesrv` action, where hardcoded values are used for AES encryption. Successful decryption or forgery of tickets allows attackers to download arbitrary files from the host machine. Reports indicate active exploitation of this flaw in the wild, with attackers leveraging it to extract sensitive configuration files and potentially execute unauthorized code. **Recommendations** Update Gladinet CentreStack and Triofox to version 16.12.10420.56791 or later.

**Name of the Vulnerable Software and Affected Versions** Gladinet CentreStack and Triofox versions prior to and including 16.7.10368.56560 **Description** Gladinet CentreStack and Triofox are affected by an unauthenticated Local File Inclusion flaw. This allows unintended disclosure of system files and, potentially, remote code execution. Exploitation of this issue has been observed in the wild, with reports of active exploitation by the CL0P ransomware group and other threat actors. At least three customers have been impacted. The vulnerability allows attackers to access system files without authentication, potentially leading to the retrieval of machine keys and subsequent remote code execution. The vulnerability is tracked as CVE-2025-11371. **Recommendations** For versions prior to and including 16.7.10368.56560, remove the lines of code that enable the exploitable functionality, as recommended by Huntress, understanding that this may impact some platform features.

**Name of the Vulnerable Software and Affected Versions** 3CX DesktopApp versions 18.11.1213 through 18.12.416 3CX DesktopApp Electron Windows application versions 18.12.407 through 18.12.416 3CX DesktopApp Electron macOS application versions 18.11.1213 through 18.12.416 **Description** The 3CX DesktopApp has embedded malicious code, which has been exploited in the wild in March 2023. This issue affects the Electron Windows and macOS applications. The malicious code allows a remote attacker to execute arbitrary code. There have been real-world incidents where this issue was exploited, with reports of a backdoor being installed on some machines, potentially as part of a targeted attack. The estimated number of affected devices is not specified, but it is reported that the attackers targeted their victims with precision. **Recommendations** For 3CX DesktopApp versions 18.11.1213 through 18.12.416, update to a version later than 18.12.416 to resolve the issue. For 3CX DesktopApp Electron Windows application versions 18.12.407 through 18.12.416, update to a version later than 18.12.416 to resolve the issue. For 3CX DesktopApp Electron macOS application versions 18.11.1213 through 18.12.416, update to a version later than 18.12.416 to resolve the issue. As a temporary workaround, consider restricting access to the affected applications until a patch is available.

Name of the Vulnerable Software and Affected Versions: vFairs version 3.3 Description: The issue allows any logged-in user to modify other users' profile information or profile picture in a vFairs virtual conference or event. By obtaining a user's unique identification number and their own, an attacker can make an HTTP POST request to update the profile description or supply a new profile image. This could lead to potential cross-site scripting attacks on any user or allow the upload of malicious PHP webshells as "profile pictures." The user IDs can be easily determined from other API responses for an event or chat room. Recommendations: For vFairs version 3.3, consider restricting access to profile modification features until a proper fix is implemented to prevent unauthorized changes. As a temporary workaround, restrict the ability to update profile descriptions or upload new profile images to minimize the risk of exploitation.