Read the docs
TI-2026-07354 Aliases CVE-2026-8360GHSA-8h36-w88j-j75h

Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS

Priority HIGH 72CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL pointer (i.e., when no user is logged into the Triofox Server Agent Management Console). The returned NULL pointer is not checked before being dereferenced.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Fix Fixed Triofox (Gladinet): 17.3.10565.57509

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GladinetTriofoxbefore 17.3.10565.5750917.3.10565.57509Patch availableCNA
  • Triofox VendorGladinet Affected before 17.3.10565.57509 Fixed in 17.3.10565.57509 Patch available CNA

Remediation

  • Fix · CNA Triofox (Gladinet) Fixed in 17.3.10565.57509

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gladinet Triofox 17.3.10565.57509

    6 records Highest priority Priority HIGH 6 HIGH

    Other records, highest priority first

    • TI-2026-07358 Gladinet Triofox Missing Authentication for Critical FunctionsPriority HIGH 82
    • TI-2026-07357 Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dllPriority HIGH 82
    • TI-2026-07356 Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dllPriority HIGH 82
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8360
  2. 2026-10-03 Alias added: GHSA-8h36-w88j-j75h

References

Other 1

  • TI-2025-21708 Hard-coded credentials in Gladinet CentreStack KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-11451 Improper access control in TrioFox KEVCVSS 3.1CRITICAL 9.1
  • TI-2025-13351 Gladinet CentreStack and TrioFox Hard Coded AES Keys KEVCVSS 4.0HIGH 7.1
  • TI-2025-10418 Gladinet CentreStack and TrioFox Local File Inclusion Flaw KEVCVSS 3.1HIGH 7.5
  • TI-2026-07358 Gladinet Triofox Missing Authentication for Critical Functions CVSS 3.1CRITICAL 9.8
  • TI-2026-07357 Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dll CVSS 3.1CRITICAL 9.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences