CVE-2025-14611KEV · OVERDUECWE-798hardcoded-credentials

Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Critical · published December 13, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.

293
days past CISA
deadline
CVSS v3.1
9.8
EPSS
53%
Percentile
99.0
In the wild
Confirmed
What it is

🚨 Hardcoded values in AES implementation are putting your security at risk! This flaw in Gladinet CentreStack and Triofox before version 16.12.10420.56791 could let attackers slip past defenses like a courier delivering packages without checking the label. 🔥 Think of it like a restaurant offering a secret menu, but the orders are filled without verifying if the ingredients are actually what they claim to be. This oversight allows anyone with the right knowledge to create a special request and access sensitive areas of the system without any authentication checks! An attacker could exploit this vulnerability to include any local file on the server, potentially leading to full system compromise! This isn't just a minor issue; it opens the floodgates for future attacks, as the hardcoded values degrade the overall security of your exposed endpoints.

Put simply

Think of it like a restaurant offering a secret menu, but the orders are filled without verifying if the ingredients are actually what they claim to be. This oversight allows anyone with the right knowledge to create a special request and access sensitive areas of the system without any authentication checks! The vulnerability stems from hardcoded values used in the AES cryptoscheme implementation in Gladinet CentreStack and Triofox. With specially crafted requests, attackers can leverage this flaw to gain unauthorized file access without the need for authentication.

What to do

An attacker could exploit this vulnerability to include any local file on the server, potentially leading to full system compromise! This isn't just a minor issue; it opens the floodgates for future attacks, as the hardcoded values degrade the overall security of your exposed endpoints. Immediate action is required: Upgrade to version 16.12.10420.56791 or later to patch this vulnerability. Additionally, review endpoint configurations and perform security audits to ensure no sensitive information is exposed. You've got this! Taking these steps will bolster your security and keep your system safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.53302 · 99.0th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2025-12-13T02:15Z
KEV added
2025-12-15 · due 2026-01-05
Affected products (2)
ProductVersionsFixed in
gladinet/centrestack< 16.12.10420.5679116.12.10420.56791
gladinet/triofox< 16.12.10420.5679116.12.10420.56791
References (2)
EPSS history
Timeline
  • 15 DEC 00:00Z
    Added to CISA KEV — remediate by Jan 5
    kev
  • 12 DEC 21:01Z
    Gladinet CentreStack and TrioFox Hard Coded AES Keys
    cvelistv5