CVE-2025-12480
Gladinet Triofox Improper Access Control Vulnerability
Description
CVE-2025-12480 is a critical improper access control vulnerability in Gladinet Triofox versions prior to 16.7.10368.56560, carrying a CVSS v3.1 score of 9.1. The flaw allows unauthenticated remote attackers to access initial setup pages even after the setup process has been completed, potentially enabling full administrative takeover of the Triofox instance. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 3, 2025, and exploitation has been confirmed in the wild by Mandiant. With an EPSS score of 0.73223 (98.8th percentile), there is an exceptionally high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gladinet | triofox | < 16.7.10368.56560 |
References
- https://access.triofox.com/releases_history/(Release Notes)
- https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480(Exploit, Third Party Advisory)
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0008.md(Third Party Advisory)
- https://www.triofox.com/(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-12480(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
CWE-284 describes a condition where a system fails to properly restrict access to resources or functionality based on a user's authorization level. In the case of CVE-2025-12480, the Triofox application does not adequately prevent access to its initial configuration and setup pages after the initial setup has already been completed. This allows an unauthenticated attacker to revisit these setup pages and potentially reconfigure the entire application, including creating new administrative accounts or modifying critical settings.
Impact Analysis
The business impact of CVE-2025-12480 is severe. Confidentiality is critically affected because an attacker who gains administrative access through the exposed setup pages can read all files stored in and managed by Triofox, including sensitive corporate documents, intellectual property, and personally identifiable information. Integrity is equally compromised since the attacker can modify system configurations, create rogue administrator accounts, alter or delete stored files, and potentially inject malicious content into the file-sharing platform. The CVSS vector confirms network-accessible exploitation with no authentication required and no user interaction needed, meaning any internet-facing Triofox instance is at immediate risk.
EPSS and threat context paint a particularly alarming picture. The EPSS score of 0.73223 places this vulnerability in the 98.8th percentile, indicating that empirical evidence strongly suggests active, widespread exploitation attempts. CISA has added this to the KEV catalog, confirming real-world exploitation. Google's Mandiant threat intelligence team has published detailed analysis of in-the-wild exploitation. The ransomware association is currently listed as unknown, but given the file-sharing nature of Triofox and the ease of exploitation, organizations should treat the ransomware risk as elevated.
Exploit Maturity
CVE-2025-12480 has been confirmed as actively exploited in the wild. CISA KEV status: This vulnerability was added to CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of December 3, 2025, applicable to all U.S. federal agencies. EPSS context: The EPSS score of 0.73223 (98.8th percentile) reflects extremely high observed exploitation activity across threat intelligence feeds, making this one of the most actively targeted vulnerabilities in recent weeks.
Public exploit intelligence: Google's Mandiant published a detailed technical analysis of CVE-2025-12480 exploitation, documenting real-world attack campaigns targeting this vulnerability. Additionally, Mandiant's vulnerability disclosure is publicly available on GitHub, providing indicators of compromise and further technical context. Ransomware association: Currently listed as unknown, but the nature of the vulnerability — providing unauthenticated administrative access to a file management platform — makes it a high-value target for ransomware operators seeking to encrypt or exfiltrate corporate data.
Remediation
-
Upgrade Triofox immediately — Update all Triofox installations to version 16.7.10368.56560 or later. Review the Triofox release history for the specific patch that addresses CVE-2025-12480 and follow the vendor's upgrade procedures.
-
Audit setup page accessibility — After upgrading, verify that the initial setup pages (typically at the /setup or /install endpoints) are no longer accessible from any network location. Attempt to navigate to these endpoints manually to confirm they return an error or redirect.
-
Review administrative accounts — Immediately audit all administrative accounts on your Triofox instance. Look for any accounts that were not created by your organization, recently created accounts with elevated privileges, or accounts with suspicious login histories. Disable or remove any unauthorized accounts.
-
Restrict network access — If immediate patching is not possible, implement network-level controls to restrict access to the Triofox management interface. Place the application behind a VPN or firewall rule that limits access to trusted IP ranges only.
-
Monitor for indicators of compromise — Review Triofox application logs and web server access logs for requests to setup or installation endpoints. Cross-reference with Mandiant's published indicators of compromise and investigate any suspicious access patterns.
Technical Details
The CVSS v3.1 vector for CVE-2025-12480 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, resulting in a critical score of 9.1. Attack Vector (Network) indicates the vulnerability is exploitable remotely over the internet without requiring any local or adjacent network access. Attack Complexity (Low) means no special conditions or timing are needed — the exploit works reliably. Privileges Required (None) and User Interaction (None) confirm that a completely unauthenticated attacker can exploit this without any social engineering.
The attack mechanism centers on Triofox's failure to properly disable or protect its initial setup workflow after installation is complete. In a normal deployment, the setup pages guide administrators through initial configuration including database connections, storage backends, and administrative account creation. Once setup is finalized, these pages should become permanently inaccessible. However, in vulnerable versions, the application fails to enforce this state transition, allowing anyone with network access to the Triofox server to navigate directly to the setup endpoints. An attacker can then re-run the setup process, effectively reconfiguring the application to their specifications, creating new administrative accounts, or modifying authentication settings. The Scope (Unchanged) metric indicates the vulnerability affects only the Triofox component itself, though the cascading impact on stored data is significant. Availability impact is rated None because the primary attack does not cause a denial of service, though an attacker with administrative access could certainly disrupt service.
Frequently Asked Questions
What is CVE-2025-12480 and why is it critical?
CVE-2025-12480 is a critical access control vulnerability in Gladinet Triofox that allows unauthenticated attackers to access the application's setup pages even after initial configuration is complete. It is critical because it enables complete administrative takeover of the Triofox platform without requiring any credentials, and it is confirmed to be actively exploited in real-world attacks.
Is CVE-2025-12480 being exploited in the wild?
Yes, this vulnerability is confirmed to be actively exploited. CISA has added it to its Known Exploited Vulnerabilities catalog, and Google's Mandiant threat intelligence team has published detailed analysis of attack campaigns leveraging this flaw. The EPSS score of 0.73223 (98.8th percentile) further corroborates widespread exploitation activity.
Which versions of Triofox are affected?
All versions of Gladinet Triofox prior to version 16.7.10368.56560 are affected. Organizations should upgrade to version 16.7.10368.56560 or later as soon as possible to remediate the vulnerability.
What should I do if I cannot patch immediately?
If immediate patching is not feasible, restrict network access to your Triofox instance by placing it behind a VPN or firewall that limits access to trusted IP addresses only. Audit existing administrative accounts for unauthorized access, and monitor access logs for any requests to setup or installation endpoints.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.