Which versions of Gladinet CentreStack are affected by CVE-2025-14611?

An unauthenticated file-inclusion flaw in Gladinet CentreStack and Triofox - enterprise file-sharing and remote-access platforms frequently exposed to the internet and used to store regulated and…

Is there a public PoC exploit available for CVE-2025-14611?

Yes, a public proof-of-concept exploit is available for CVE-2025-14611. Prioritise patching immediately. EPSS: 53.3%.

How to fix or mitigate CVE-2025-14611?

Within 24 hours, inventory every internet-facing CentreStack and Triofox instance, confirm the running build against the affected range (versions before 16.12.10420.56791), remove or restrict public exposure of any deployment that cannot be immediately remediated, and review logs for anomalous file-inclusion requests targeting the exposed endpoints; because no vendor-released patch is identified at the time of analysis, treat this as an emergency exposure-reduction exercise rather than a routine patch cycle. Within 7 days, contact Gladinet support to obtain the fixed build 16.12.10420.56791 or later if it is confirmed available, and if it is not, implement the interim controls below - WAF/IPS rules blocking traversal and inclusion patterns, IP allow-listing or VPN-only access for administrative and remote endpoints, and rotation of any credentials or keys stored on or near these hosts - and verify that previously disclosed Gladinet vulnerabilities have already been remediated, since escalation to full compromise depends on chaining them. Within 30 days, complete migration of all affected instances to a supported, fixed release (minimum 16.12.10420.56791 or the vendor's latest), re-audit external attack surface to ensure no legacy deployments remain publicly reachable, validate that compensating controls remain enforced until the upgrade is complete, and confirm with the vendor in writing whether a formal patch advisory exists for CVE-2025-14611.

Gladinet CentreStack CVE-2025-14611

Q: What is the CVSS score of CVE-2025-14611?

CVE-2025-14611 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 53.3%.

HIGH

Use of Hard-coded Credentials (CWE-798)

2025-12-12 5dacb0b8-2277-4717-899c-254586fe4912

Authentication Bypass Centrestack Triofox Gladinet

7.1

CVSS 4.0 · Vendor: 5dacb0b8-2277-4717-899c-254586fe4912

Severity by source

Vendor (5dacb0b8-2277-4717-899c-254586fe4912) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.0 MEDIUM

Unauthenticated network request (AV:N/PR:N/UI:N) but crypto-abuse crafting raises AC:H; LFI yields limited confidentiality (C:L) and crosses a trust boundary, so S:C.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (5dacb0b8-2277-4717-899c-254586fe4912).

CVSS VectorVendor: 5dacb0b8-2277-4717-899c-254586fe4912

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Oct 07, 2026 - 21:40 vuln.today

tag: Gladinet added

Analysis Generated

Oct 07, 2026 - 20:40 vuln.today

Added to CISA KEV

Oct 07, 2026 - 20:32 CISA

CVE Published

Dec 12, 2025 - 21:15 cve.org

HIGH 7.1

DescriptionCVE.org

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.

AnalysisAI

Unauthenticated arbitrary local file inclusion affects Gladinet CentreStack and Triofox deployments before 16.12.10420.56791 because hardcoded AES key values undermine the products' cryptography; the flaw is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and EPSS is 53.30% (99th percentile). Exploitation is limited to publicly exposed endpoints and requires high attack complexity, and full system compromise depends on chaining this issue with previously disclosed Gladinet vulnerabilities, but the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N shows no authentication or user interaction is needed. Successful attacks can expose local files and, in combination with other flaws, enable broader system compromise.

Technical ContextAI

The affected CentreStack and Triofox products implement an AES cryptoscheme using hardcoded values, which maps to CWE-798 (Use of Hard-coded Credentials). Because cryptographic key material is embedded in the product rather than generated or managed securely, publicly exposed endpoints may accept specially crafted requests that undermine intended protections and reach an arbitrary local file inclusion condition without authentication. The CPE records cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:* and cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:* identify both Gladinet products as affected across versions before the fixed release. The assessed CVSS:3.1 vector shows network attack vector, high attack complexity, no privileges required, no user interaction, and changed scope with low confidentiality impact, while integrity and availability impacts are none; the description further notes this can be leveraged with previous vulnerabilities such as authentication bypass and other chaining opportunities for future exploitation.

RemediationAI

Vendor-released patch: upgrade Gladinet CentreStack and Triofox to version 16.12.10420.56791 or later, which is the fixed version referenced in the CVE description. If immediate upgrade is not possible, remove public exposure of CentreStack and Triofox endpoints, restrict access through trusted networks or VPN-only paths, and block untrusted inbound requests to the affected services; the trade-off is reduced remote accessibility for legitimate users. Because this issue can be chained with previous Gladinet vulnerabilities, review systems for post-exploitation activity, monitor for crafted requests that target file inclusion, and consider rotating secrets or credentials that may have been exposed through local file disclosure. Consult the Huntress advisory at https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability and the CISA KEV catalog entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14611 for current guidance.