Vulnerability details
CVE-2025-11371
Actively exploited
Gladinet CentreStack and TrioFox
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
CVSS 3.1
7.5High
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-11-25)
Official description
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Gladinet | CentreStack and TrioFox | v ≤ 16.7.10368.56560 | CVEProject cvelistV5 (CNA) |
References and advisories
3
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-10-09
- Last updated
- 2026-09-21
- State
- Published
- Assigner (CNA)
- Huntress
- Kolun priority
- 76 · High
CISA KEV catalog
- Date added
- 2025-11-04
- Due date
- 2025-11-25
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
92.13%
Probability of exploitation in 30 days
99.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-552Files or Directories Accessible to External Parties