Vulnerability details
CVE-2025-14611
Actively exploited
Gladinet CentreStack and TrioFox
Gladinet CentreStack and TrioFox Hard Coded AES Keys
CVSS 4.0
7.1High
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2026-01-05)
Versions not listed as affected in the CVE record:
- CentreStack and TrioFox — version 16.12.10420.56791 and later
Official description
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 4.0 | CVEProject cvelistV5 (CNA) (Huntress) | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Gladinet | CentreStack and TrioFox | v < 16.12.10420.56791 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-12-13
- Last updated
- 2026-02-26
- State
- Published
- Assigner (CNA)
- Huntress
- Kolun priority
- 75 · High
CISA KEV catalog
- Date added
- 2025-12-15
- Due date
- 2026-01-05
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
53.3%
Probability of exploitation in 30 days
98.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-798Use of Hard-coded Credentials