CVE-2025-11371
Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Description
CVE-2025-11371 is a high-severity unauthenticated local file inclusion vulnerability in Gladinet CentreStack and Triofox, rated at CVSS v3.1 score of 7.5. The flaw exists in the default installation and configuration of both products, allowing external attackers to read arbitrary system files without authentication. Exploitation has been observed in the wild, and CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 25, 2025. With an EPSS score of 0.71001 (98.7th percentile), this vulnerability is among the most actively exploited flaws currently tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| gladinet | centrestack | < 16.10.10408.56683 |
| gladinet | triofox | <= 16.7.10368.56560 |
References
- https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw(Exploit, Third Party Advisory)
- https://www.centrestack.com/p/gce_latest_release.html(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11371(US Government Resource)
Weakness Type
CWE-552: Files or Directories Accessible to External Parties
CWE-552 describes a condition where an application makes files or directories accessible to unauthorized external parties, typically by failing to properly restrict file path traversal or by exposing sensitive file system resources through the application's interface. In CVE-2025-11371, the default configuration of Gladinet CentreStack and Triofox allows unauthenticated remote users to include and read local server files through a local file inclusion (LFI) flaw, exposing sensitive system configuration files, credentials, and application data.
Impact Analysis
The business impact of CVE-2025-11371 is significant, with confidentiality being the primary concern as indicated by the high confidentiality impact rating. An attacker exploiting this local file inclusion vulnerability can read arbitrary files from the server, including Windows system files such as SAM and SYSTEM registry hives (which contain password hashes), application configuration files containing database credentials and API keys, SSL/TLS private keys, and any documents stored on the server's file system.
While integrity and availability are not directly impacted by the file reading capability itself, the information disclosed through this vulnerability frequently enables follow-up attacks. Exposed credentials can be used to authenticate to administrative interfaces, database connection strings enable direct database manipulation, and exposed private keys compromise encrypted communications. The EPSS score of 0.71001 (98.7th percentile) indicates this vulnerability is being actively and widely exploited. The fact that exploitation affects the default installation and requires no authentication means every unpatched instance of CentreStack and Triofox is vulnerable out of the box. Ransomware association is listed as unknown, but the credentials and access obtained through LFI exploitation are commonly used as stepping stones in ransomware attack chains. Organizations using Gladinet products should note that this vulnerability affects both CentreStack and Triofox, so both products must be assessed and patched.
Exploit Maturity
CVE-2025-11371 is confirmed as actively exploited in the wild, with the vendor's own advisory acknowledging observed exploitation. CISA KEV status: Added to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of November 25, 2025. EPSS context: The score of 0.71001 (98.7th percentile) places this among the most actively exploited vulnerabilities in the current threat landscape.
Public exploit intelligence: Huntress has published a detailed technical analysis and exploitation guide documenting the local file inclusion vulnerability in both CentreStack and Triofox. This writeup provides sufficient technical detail for reproduction and has been tagged as both an exploit and third-party advisory. Ransomware association: Currently listed as unknown, though the information disclosure capability of this LFI vulnerability is commonly chained with other attacks to achieve full system compromise.
Remediation
-
Update CentreStack and Triofox — Upgrade CentreStack to version 16.10.10408.56683 or later, and Triofox to a version later than 16.7.10368.56560. Review the CentreStack release notes for the specific patch addressing this vulnerability.
-
Validate the patch is effective — After upgrading, attempt to reproduce the local file inclusion by requesting known system file paths through the vulnerable endpoint. Verify that the application returns an error or access denied response rather than file contents.
-
Audit for data exposure — If your installation was running an unpatched version, assume that sensitive files have been read by attackers. Identify which files could have been exposed (configuration files, credential stores, private keys) and rotate all potentially compromised credentials, including database passwords, API keys, and service account passwords.
-
Implement network access controls — Restrict access to the CentreStack and Triofox web interfaces to trusted IP ranges using firewall rules or a reverse proxy with IP allowlisting. This reduces the attack surface for any future vulnerabilities in these products.
-
Monitor for follow-up attacks — Since LFI exploitation typically provides credentials and configuration data that enable subsequent attacks, monitor for authentication attempts using credentials that may have been exposed, lateral movement within the network, and unauthorized access to databases or services referenced in exposed configuration files.
Technical Details
The CVSS v3.1 vector for CVE-2025-11371 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, resulting in a high score of 7.5. Attack Vector (Network) confirms remote exploitation over the internet. Attack Complexity (Low) means the LFI can be triggered reliably with a simple crafted request. Privileges Required (None) and User Interaction (None) indicate completely unauthenticated exploitation. The Confidentiality (High) impact with no integrity or availability impact is characteristic of file disclosure vulnerabilities.
The vulnerability is a local file inclusion (LFI) flaw present in the default installation and configuration of both Gladinet CentreStack and Triofox. The application processes user-supplied file path parameters without adequately sanitizing directory traversal sequences or restricting access to files outside the intended web root. An attacker can craft HTTP requests that include path traversal characters (such as ../ sequences or absolute paths) to reference arbitrary files on the server's file system. The application then reads and returns the contents of the specified file in its response. Because this flaw exists in the default configuration, no special setup or misconfiguration is required for exploitation — every installation is vulnerable unless specifically patched. The affected versions include all CentreStack releases prior to 16.10.10408.56683 and all Triofox releases up to and including 16.7.10368.56560. The Scope (Unchanged) metric indicates the vulnerability affects only the CentreStack/Triofox application boundary, though the disclosed information typically enables attacks against other components.
Frequently Asked Questions
What is CVE-2025-11371?
CVE-2025-11371 is a local file inclusion vulnerability in Gladinet CentreStack and Triofox that allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability exists in the default installation configuration of both products, meaning all unpatched instances are affected.
Are both CentreStack and Triofox affected?
Yes, both Gladinet products are affected. CentreStack versions prior to 16.10.10408.56683 and Triofox versions up to and including 16.7.10368.56560 are vulnerable. Both products must be updated separately to remediate the vulnerability.
What information can an attacker obtain?
An attacker can read any file on the server that the web application process has permission to access. This typically includes system configuration files, application configuration files containing database credentials and API keys, SSL/TLS certificates and private keys, and any user documents stored on the server's file system.
Is this related to CVE-2025-12480?
While both CVE-2025-11371 and CVE-2025-12480 affect Gladinet products, they are distinct vulnerabilities. CVE-2025-12480 is an access control flaw in Triofox's setup pages, while CVE-2025-11371 is a file inclusion vulnerability affecting both CentreStack and Triofox. Organizations using Gladinet products should ensure they are patched against both vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.