ZeroDay Findings
Sign inSign up

Findings

CVE-2025-14611

Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Published Dec 12, 2025 · updated Oct 7, 2026 · Gladinet CentreStack and Triofox

Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 12, 2025 · Catalog

    Detected

    Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with pre

  2. Dec 15, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Jan 5, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Oct 7, 2026 · Catalog

    Updated

    Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with pre

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Jan 5, 2026

Affected

  • cpe gladinet/centrestackversion unspecified
  • cpe gladinet/triofoxversion unspecified
  • vendor Gladinet CentreStack and Triofoxversion unspecified

Sources

  • CISA KEVCVE-2025-14611

    Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.

    cisa.gov
  • CVE.orgCVE-2025-14611

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-14611

    30-day exploitation probability 53.3%

    first.org
  • Metasploit Modulesauxiliary_gather/gladinet_storage_access_ticket_forge

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2025-14611

    Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a spe

    nvd.nist.gov

References