What is the CVSS score of CVE-2025-12480?

CVE-2025-12480 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 75.9%.

Which versions of Triofox are affected by CVE-2025-12480?

CVE-2025-12480 presents critical security risk, a improper access control vulnerability rated CVSS 9.1.

Is there a public PoC exploit available for CVE-2025-12480?

Yes, a public proof-of-concept exploit is available for CVE-2025-12480. Prioritise patching immediately. EPSS: 75.9%.

How to fix or mitigate CVE-2025-12480?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Triofox CVE-2025-12480

CRITICAL

Improper Access Control (CWE-284)

2025-11-10 mandiant-cve@google.com

Authentication Bypass Triofox

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:21 vuln.today

Added to CISA KEV

Nov 14, 2025 - 02:00 cisa

CISA KEV

PoC Detected

Nov 14, 2025 - 02:00 vuln.today

Public exploit code

CVE Published

Nov 10, 2025 - 15:15 nvd

CRITICAL 9.1

DescriptionCVE.org

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

AnalysisAI

Triofox versions before 16.7.10368.56560 contain an improper access control flaw allowing access to initial setup pages after setup is complete, enabling reconfiguration attacks.

Technical ContextAI

The CWE-284 improper access control fails to disable setup wizard endpoints after initial configuration, allowing attackers to reconfigure the system.

RemediationAI

Update Triofox. Verify setup pages are inaccessible. Audit admin accounts.

CVE-2025-12480 vulnerability details – vuln.today

Back

Triofox CVE-2025-12480

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code