Gladinet
Monthly
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete arbitrary account settings by hitting API endpoints that lack authorization checks (CWE-306). Because a static shared encryption key is used to generate valid encrypted EntAcctId values, an attacker can forge identifiers for any user GUID - including the system-wide cluster settings account - to enumerate hosted tenant domains and administrator identities. There is no public exploit identified at time of analysis, but the flaw was surfaced by VulnCheck and requires no authentication.
Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary server files by abusing an XML External Entity (XXE) flaw in the SharePoint StorageConfig handler. By pointing the storage configuration at a malicious URL, an attacker forces the server to parse attacker-controlled XML with external DTD references and leak sensitive files such as Web.config, exposing database credentials and cryptographic key material. Reported by VulnCheck; no public exploit identified at time of analysis, and the CVSS 4.0 base score is 8.7 (High).
Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure deserialization path in GSNamespace.dll to add arbitrary local Windows accounts. By posting a crafted base64-encoded XML StorageConfigure value to the exposed jsonimportuserbyupn/jsonimportuserbyupnex/japiimportuserbyupn endpoints, an attacker (no credentials, per CVSS PR:N) drives InternalImportAdUserByUPN() to call NetUserAdd with attacker-chosen credentials and to create arbitrary server directories. No public exploit identified at time of analysis and it is not in CISA KEV, but the same product family has a prior history of actively exploited flaws, so weight this accordingly.
Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a static SysNumber used as entropy for AccessTicket.Encrypt/Decrypt across all installations), letting attackers forge valid x-glad-auth headers, invoke privileged endpoints like acquiretenantbackuptoken, and escalate to a domain administrator IdentityTicket for full server takeover. Reported by VulnCheck and carrying a CVSS 4.0 base of 9.3, it is remotely exploitable against default configurations with no authentication or user interaction. No public exploit code or CISA KEV listing is confirmed in the provided data, so at time of analysis there is no public exploit identified.
Denial of service in Gladinet Triofox lets unauthenticated remote attackers crash the web service by sending an HTTP request whose URL path begins with /status or /sysinfo. The server tries to load WOSHttpStatusModule.dll to service those paths and calls WOSBin_LoadHttpModule, but that DLL ships missing from the installation, so the resolved function pointer is NULL and the code invokes a function at address 0, terminating the process (CWE-476). The flaw was discovered and reported by Tenable (TRA-2026-45); no public exploit identified at time of analysis and it is not on the CISA KEV list, with availability-only impact (CVSS 7.5).
Denial of service in Gladinet Triofox lets remote unauthenticated attackers crash the Triofox Server Agent by triggering a NULL pointer dereference. The function WOSSysInfoGetDeviceInterface() in WOSCommonUtil.dll returns NULL whenever no user is logged into the Server Agent Management Console, and callers such as WOSProfileMgrModule.dll and WOSWebDavModule.dll dereference that pointer without checking it, causing a process crash. There is no public exploit identified at time of analysis and the issue affects only availability (CVSS 7.5).
Information disclosure via path traversal in Gladinet Triofox lets remote unauthenticated attackers read arbitrary files on the server by sending crafted requests whose URL path begins with /woshome, which are handled by the WOSDefaultHttpModule.dll component. The CVSS 7.5 scoring (confidentiality-only impact) reflects unrestricted file read without code execution or service disruption. No public exploit has been identified at time of analysis, and the issue was reported by Tenable rather than appearing in CISA KEV.
Remote code execution in Gladinet Triofox is possible through a stack-based buffer overflow in WOSDefaultHttpModule.dll, which fails to bounds-check overly long URL paths beginning with /woshome. Because the flaw is reachable over the network with no authentication and no user interaction (CVSS 9.8), an attacker who can reach the Triofox web service can corrupt the stack and potentially execute arbitrary code in the context of the web module. No public exploit has been identified at the time of analysis, and the issue was reported by Tenable (TRA-2026-45).
Remote code execution in Gladinet Triofox is possible through a stack-based buffer overflow in the WOSDeviceDropFolder.dll component, which mishandles overly long URL paths that begin with /resources. The CVSS 9.8 vector indicates an unauthenticated, network-reachable flaw requiring no user interaction, meaning any attacker who can reach the Triofox web service can corrupt the stack and potentially execute arbitrary code. The issue was reported by Tenable (TRA-2026-45); no public exploit identified at time of analysis and no EPSS score was provided in the source data.
Missing authentication in Gladinet Triofox's Cloud Server Agent Access Service (GladServerAgentService.exe) lets remote, unauthenticated attackers reach privileged HTTP endpoints exposed on TCP port 7878. The service processes requests to paths such as /resources, /status, /sysinfo, /woshome, /Settings, /schedule, and /DavCache without an authentication check (CWE-306), and the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) rates the impact as full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and no EPSS score was provided, but the 9.8 base score and unauthenticated network reachability make this a critical-priority issue for any internet-exposed Triofox deployment.
Triofox versions before 16.7.10368.56560 contain an improper access control flaw allowing access to initial setup pages after setup is complete, enabling reconfiguration attacks.
Gladinet CentreStack contains a deserialization vulnerability caused by a hardcoded machineKey in the portal, allowing unauthenticated remote code execution through crafted ViewState payloads.
Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass authentication and access management pages without credentials. By embedding newline and tab characters into the AccountName parameter posted to SelectProvider.aspx, attackers exploit the absence of input sanitization in the product's custom session serialization format to inject an arbitrary resellerid session variable, which satisfies the IsValidRSession authentication check and opens management interfaces. No public exploit has been identified at time of analysis, though VulnCheck discovered and reported this issue with sufficient detail to facilitate reproduction.
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user account, without. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete arbitrary account settings by hitting API endpoints that lack authorization checks (CWE-306). Because a static shared encryption key is used to generate valid encrypted EntAcctId values, an attacker can forge identifiers for any user GUID - including the system-wide cluster settings account - to enumerate hosted tenant domains and administrator identities. There is no public exploit identified at time of analysis, but the flaw was surfaced by VulnCheck and requires no authentication.
Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary server files by abusing an XML External Entity (XXE) flaw in the SharePoint StorageConfig handler. By pointing the storage configuration at a malicious URL, an attacker forces the server to parse attacker-controlled XML with external DTD references and leak sensitive files such as Web.config, exposing database credentials and cryptographic key material. Reported by VulnCheck; no public exploit identified at time of analysis, and the CVSS 4.0 base score is 8.7 (High).
Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure deserialization path in GSNamespace.dll to add arbitrary local Windows accounts. By posting a crafted base64-encoded XML StorageConfigure value to the exposed jsonimportuserbyupn/jsonimportuserbyupnex/japiimportuserbyupn endpoints, an attacker (no credentials, per CVSS PR:N) drives InternalImportAdUserByUPN() to call NetUserAdd with attacker-chosen credentials and to create arbitrary server directories. No public exploit identified at time of analysis and it is not in CISA KEV, but the same product family has a prior history of actively exploited flaws, so weight this accordingly.
Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a static SysNumber used as entropy for AccessTicket.Encrypt/Decrypt across all installations), letting attackers forge valid x-glad-auth headers, invoke privileged endpoints like acquiretenantbackuptoken, and escalate to a domain administrator IdentityTicket for full server takeover. Reported by VulnCheck and carrying a CVSS 4.0 base of 9.3, it is remotely exploitable against default configurations with no authentication or user interaction. No public exploit code or CISA KEV listing is confirmed in the provided data, so at time of analysis there is no public exploit identified.
Denial of service in Gladinet Triofox lets unauthenticated remote attackers crash the web service by sending an HTTP request whose URL path begins with /status or /sysinfo. The server tries to load WOSHttpStatusModule.dll to service those paths and calls WOSBin_LoadHttpModule, but that DLL ships missing from the installation, so the resolved function pointer is NULL and the code invokes a function at address 0, terminating the process (CWE-476). The flaw was discovered and reported by Tenable (TRA-2026-45); no public exploit identified at time of analysis and it is not on the CISA KEV list, with availability-only impact (CVSS 7.5).
Denial of service in Gladinet Triofox lets remote unauthenticated attackers crash the Triofox Server Agent by triggering a NULL pointer dereference. The function WOSSysInfoGetDeviceInterface() in WOSCommonUtil.dll returns NULL whenever no user is logged into the Server Agent Management Console, and callers such as WOSProfileMgrModule.dll and WOSWebDavModule.dll dereference that pointer without checking it, causing a process crash. There is no public exploit identified at time of analysis and the issue affects only availability (CVSS 7.5).
Information disclosure via path traversal in Gladinet Triofox lets remote unauthenticated attackers read arbitrary files on the server by sending crafted requests whose URL path begins with /woshome, which are handled by the WOSDefaultHttpModule.dll component. The CVSS 7.5 scoring (confidentiality-only impact) reflects unrestricted file read without code execution or service disruption. No public exploit has been identified at time of analysis, and the issue was reported by Tenable rather than appearing in CISA KEV.
Remote code execution in Gladinet Triofox is possible through a stack-based buffer overflow in WOSDefaultHttpModule.dll, which fails to bounds-check overly long URL paths beginning with /woshome. Because the flaw is reachable over the network with no authentication and no user interaction (CVSS 9.8), an attacker who can reach the Triofox web service can corrupt the stack and potentially execute arbitrary code in the context of the web module. No public exploit has been identified at the time of analysis, and the issue was reported by Tenable (TRA-2026-45).
Remote code execution in Gladinet Triofox is possible through a stack-based buffer overflow in the WOSDeviceDropFolder.dll component, which mishandles overly long URL paths that begin with /resources. The CVSS 9.8 vector indicates an unauthenticated, network-reachable flaw requiring no user interaction, meaning any attacker who can reach the Triofox web service can corrupt the stack and potentially execute arbitrary code. The issue was reported by Tenable (TRA-2026-45); no public exploit identified at time of analysis and no EPSS score was provided in the source data.
Missing authentication in Gladinet Triofox's Cloud Server Agent Access Service (GladServerAgentService.exe) lets remote, unauthenticated attackers reach privileged HTTP endpoints exposed on TCP port 7878. The service processes requests to paths such as /resources, /status, /sysinfo, /woshome, /Settings, /schedule, and /DavCache without an authentication check (CWE-306), and the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) rates the impact as full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and no EPSS score was provided, but the 9.8 base score and unauthenticated network reachability make this a critical-priority issue for any internet-exposed Triofox deployment.
Triofox versions before 16.7.10368.56560 contain an improper access control flaw allowing access to initial setup pages after setup is complete, enabling reconfiguration attacks.
Gladinet CentreStack contains a deserialization vulnerability caused by a hardcoded machineKey in the portal, allowing unauthenticated remote code execution through crafted ViewState payloads.
Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass authentication and access management pages without credentials. By embedding newline and tab characters into the AccountName parameter posted to SelectProvider.aspx, attackers exploit the absence of input sanitization in the product's custom session serialization format to inject an arbitrary resellerid session variable, which satisfies the IsValidRSession authentication check and opens management interfaces. No public exploit has been identified at time of analysis, though VulnCheck discovered and reported this issue with sufficient detail to facilitate reproduction.
An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows authenticated attackers to execute arbitrary code by. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user account, without. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.