CVE-2025-12480criticalunder attackCWE-284

CVE-2025-12480: critical vulnerability in TrioFox

Published · Updated

Follow this CVE+ Monitor Triofox+ Monitor TrioFox

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.1epss 96%
from disclosure to weapon
Published on NVDNov 10
CISA KEV+2d
Action required by CISAfederal deadline: 2025-12-03

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Triofox versions before 16.7.10368.56560 have a flaw that allows attackers to access the initial setup pages even after installation is finished. This is dangerous because setup pages typically contain sensitive configuration options and administrative functions that should only be available during installation.

Technical detail

An improper access control vulnerability (CWE-284) in Triofox allows unauthenticated or unauthorized users to bypass access restrictions and reach initial setup interfaces post-deployment. This enables attackers to reconfigure system settings, modify administrative credentials, or extract sensitive configuration data without requiring valid authentication credentials.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
TrioFox · TrioFox