Read the docs
TI-2025-10418 Aliases CVE-2025-11371GHSA-hj6h-fpv2-5h4v

Gladinet CentreStack and TrioFox Local File Inclusion Flaw

Priority CRITICAL 90Exploited in the wildCWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-552.

Summary

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

Why it matters now

Exploitation Active In CISA KEV since 2025-11-04CISA due date 2025-11-25
EPSS 0.92137 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GladinetCentreStack and TrioFoxup to 16.7.10368.56560—No fix listedCNA
  • CentreStack and TrioFox VendorGladinet Affected up to 16.7.10368.56560 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*before 16.10.10408.56683VulnerableGladinet
cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:*up to 16.7.10368.56560VulnerableGladinet
  • cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:* Versions before 16.10.10408.56683 Vulnerable ·Gladinet
  • cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:* Versions up to 16.7.10368.56560 Vulnerable ·Gladinet

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2025-11-04 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-11371
  3. 2026-10-03 Alias added: GHSA-hj6h-fpv2-5h4v

References

Exploit 1

  • TI-2025-21708 Hard-coded credentials in Gladinet CentreStack KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-13351 Gladinet CentreStack and TrioFox Hard Coded AES Keys KEVCVSS 4.0HIGH 7.1
  • TI-2023-11791 An authentication bypass vulnerability in the Password Reset component of Gladinet… CVSS 3.1CRITICAL 9.8
  • TI-2023-11792 An unrestricted file upload vulnerability in the administrative portal branding component… CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences