CVE-2025-14611highunder attackCWE-798

CVE-2025-14611: high-severity vulnerability in Gladinet CentreStack and TrioFox

Gladinet CentreStack and TrioFox Hard Coded AES Keys

Published · Updated

Follow this CVE+ Monitor CentreStack+ Monitor Triofox

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

98Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.1epss 53%
from disclosure to weapon17 days
Published on NVDDec 12
1st PoC+17d
metasploitDec 10
CISA KEV+3d
Action required by CISAfederal deadline: 2026-01-05

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Gladinet CentreStack and TrioFox use hardcoded encryption keys instead of unique ones, which weakens security and allows unauthorized access to files on public-facing systems without logging in.

Technical detail

CWE-798 hardcoded cryptographic keys in AES implementation allows unauthenticated attackers to craft requests targeting publicly exposed endpoints for arbitrary local file inclusion (LFI); impacts versions prior to 16.12.10420.56791 and may chain with other vulnerabilities for system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A
Affected products
Gladinet · CentreStack and TrioFox
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Gladinet CentreStack and TrioFox

In the same product, most dangerous first.

CVE-2025-11371HIGHGladinet CentreStack and TrioFox Local File Inclusion FlawEPSS 92.1%KEV