PT-2025-50981 · Triofox+1 · Triofox+1

Bryan Masters + 1 · Published 2025-12-12 · Updated 2026-04-22 · CVE-2025-14611

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gladinet CentreStack and Triofox versions prior to 16.12.10420.56791

Description Gladinet CentreStack and Triofox utilize hardcoded values in their AES cryptoscheme implementation. This weakens security, particularly for publicly exposed endpoints, and allows for arbitrary local file inclusion through specially crafted, unauthenticated requests. Exploitation of this issue can potentially lead to a full system compromise, especially when combined with other existing weaknesses. The vulnerability resides in the UploadDownloadProxy component's filesrv action, where hardcoded values are used for AES encryption. Successful decryption or forgery of tickets allows attackers to download arbitrary files from the host machine. Reports indicate active exploitation of this flaw in the wild, with attackers leveraging it to extract sensitive configuration files and potentially execute unauthorized code.

Recommendations Update Gladinet CentreStack and Triofox to version 16.12.10420.56791 or later.

Exploit

Fix

LPE

RCE

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-14611

Affected Products

Gladinet Centrestack

Triofox

References · 28

• 🔥 https://huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14611 · Security Note
• https://centrestack.com/p/gce_latest_release.html · Security Note
• https://access.triofox.com/releases_history · Security Note
• https://support.centrestack.com/hc/en-us/articles/360007159054-Hardening-the-CentreStack-Cluster#h_01JQRV57T37HJFQZKBZH9NBXQP · Security Note
• https://osv.dev/vulnerability/CVE-2025-14611 · Vendor Advisory
• https://twitter.com/pdnuclei_bot/status/2001834905484038176 · Twitter Post
• https://twitter.com/ox0ffff/status/2004673967114629301 · Twitter Post
• https://twitter.com/TheCyphere/status/2046943332107256102 · Twitter Post
• https://twitter.com/TheExploitLab/status/2005892961247375796 · Twitter Post
• https://reddit.com/r/horizon3ai/comments/1pqy4dx/cve202514611_gladinet_centrestack_triofox_local · Reddit Post
• https://t.me/cveNotify/145890 · Telegram Post
• https://t.me/CSIRT_italia/2993 · Telegram Post
• https://twitter.com/Horizon3ai/status/2002141829425238153 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1pq69p4/gladinet_centrestack_and_triofox_face_critical · Reddit Post