Critical · published December 13, 2025
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.
🚨 Hardcoded values in AES implementation are putting your security at risk! This flaw in Gladinet CentreStack and Triofox before version 16.12.10420.56791 could let attackers slip past defenses like a courier delivering packages without checking the label. 🔥 Think of it like a restaurant offering a secret menu, but the orders are filled without verifying if the ingredients are actually what they claim to be. This oversight allows anyone with the right knowledge to create a special request and access sensitive areas of the system without any authentication checks! An attacker could exploit this vulnerability to include any local file on the server, potentially leading to full system compromise! This isn't just a minor issue; it opens the floodgates for future attacks, as the hardcoded values degrade the overall security of your exposed endpoints.
Think of it like a restaurant offering a secret menu, but the orders are filled without verifying if the ingredients are actually what they claim to be. This oversight allows anyone with the right knowledge to create a special request and access sensitive areas of the system without any authentication checks! The vulnerability stems from hardcoded values used in the AES cryptoscheme implementation in Gladinet CentreStack and Triofox. With specially crafted requests, attackers can leverage this flaw to gain unauthorized file access without the need for authentication.
An attacker could exploit this vulnerability to include any local file on the server, potentially leading to full system compromise! This isn't just a minor issue; it opens the floodgates for future attacks, as the hardcoded values degrade the overall security of your exposed endpoints. Immediate action is required: Upgrade to version 16.12.10420.56791 or later to patch this vulnerability. Additionally, review endpoint configurations and perform security audits to ensure no sensitive information is exposed. You've got this! Taking these steps will bolster your security and keep your system safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| gladinet/centrestack | < 16.12.10420.56791 | 16.12.10420.56791 |
| gladinet/triofox | < 16.12.10420.56791 | 16.12.10420.56791 |