CVE-2025-14611
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
Description
CVE-2025-14611 is a critical vulnerability in Gladinet CentreStack and Triofox caused by the use of hard-coded credentials in the AES cryptographic implementation. With a CVSS v3.1 base score of 9.8, this flaw allows an unauthenticated remote attacker to exploit the hard-coded cryptographic keys to achieve arbitrary local file inclusion on publicly exposed endpoints without authentication. Versions prior to 16.12.10420.56791 of both CentreStack and Triofox are affected. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 5, 2026, and carries an exceptionally high EPSS score of 0.58283 (98.1st percentile), indicating that exploitation is widespread and highly probable.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gladinet | centrestack | < 16.12.10420.56791 |
| gladinet | triofox | < 16.12.10420.56791 |
References
- https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14611(US Government Resource)
Weakness Type
CWE-798: Use of Hard-coded Credentials
CVE-2025-14611 is classified under CWE-798, which describes the practice of embedding fixed credentials, keys, or secrets directly in source code or configuration files. In this case, Gladinet CentreStack and Triofox used hard-coded values in their AES cryptographic implementation, meaning every installation of the affected software shares the same cryptographic keys. This fundamentally undermines the security provided by encryption, as any attacker who discovers the hard-coded keys can decrypt protected data, forge encrypted tokens, or craft requests that the application considers legitimately signed. Hard-coded credentials are particularly dangerous because they cannot be changed by administrators without code modification, and every deployed instance is simultaneously vulnerable once the keys become known. Learn more about CWE-798
Impact Analysis
Confidentiality, Integrity, and Availability are all rated as high impact (C:H/I:H/A:H). The hard-coded AES keys allow attackers to bypass encryption-based access controls on publicly exposed endpoints, enabling arbitrary local file inclusion. This means an attacker can read sensitive files from the server filesystem, potentially including configuration files with database credentials, user data, and other secrets. The ability to craft authenticated requests also opens pathways to modify data and disrupt service availability.
Business Impact is severe for organizations using CentreStack or Triofox for enterprise file sharing and remote access. These products are designed to provide secure file synchronization and sharing, often replacing or extending cloud storage solutions. A compromise of the cryptographic layer means all data managed by the platform, including shared files, user credentials, and access tokens, should be considered potentially exposed. Organizations in regulated industries face additional compliance and notification obligations.
Exploitation Probability is extremely high. The EPSS score of 0.58283 (98.1st percentile) indicates that this vulnerability is among the most actively exploited CVEs currently tracked. Huntress has published detailed research on active exploitation, confirming real-world attacks leveraging this flaw. The combination of hard-coded keys being universally shared across installations and the availability of public exploit information makes mass exploitation straightforward.
Exploit Maturity
CVE-2025-14611 has confirmed, widespread active exploitation. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 5, 2026. The EPSS score of 0.58283 (98.1st percentile) places it among the most heavily exploited vulnerabilities in the current threat landscape, indicating that exploitation is not merely possible but actively occurring at scale.
Huntress has published a detailed analysis of active exploitation of this vulnerability, documenting real-world attack campaigns targeting Gladinet deployments. The nature of the vulnerability, hard-coded cryptographic keys shared across all installations, means that once the key values are known, every unpatched instance is trivially exploitable. Public exploit code is available and the exploitation technique requires no authentication, no user interaction, and involves low attack complexity. The ransomware association is listed as "Unknown" by CISA, but the ability to achieve arbitrary file access and potential code execution makes this vulnerability a viable initial access vector for ransomware operators.
Remediation
-
Upgrade to Gladinet CentreStack and Triofox Version 16.12.10420.56791 or Later — This is the most critical remediation step. The patched version replaces the hard-coded AES cryptographic values with properly generated, instance-specific keys. Apply this update immediately to both CentreStack and Triofox installations.
-
Rotate All Credentials and Secrets — After patching, assume that any credentials or secrets stored on or accessible through the Gladinet platform have been potentially compromised. Rotate database passwords, API keys, user passwords, and any other secrets that may have been accessible through the file inclusion vulnerability.
-
Restrict Public Endpoint Exposure — Review which Gladinet endpoints are publicly accessible and limit exposure to only those required for legitimate business operations. Place the application behind a reverse proxy or web application firewall that can filter malicious requests targeting the vulnerable cryptographic endpoints.
-
Audit Access Logs for Exploitation Indicators — Review web server and application logs for unusual file access patterns, particularly requests to endpoints that leverage encrypted parameters. Look for indicators documented in the Huntress research on active exploitation of this vulnerability.
-
Conduct Forensic Assessment if Exposed — If the Gladinet instance was publicly accessible prior to patching, conduct a thorough forensic assessment to determine whether the system was compromised. Examine file system access logs, network connections, and any changes to configuration files or user accounts.
Technical Details
CVE-2025-14611 targets the cryptographic implementation in Gladinet CentreStack and Triofox, where hard-coded values were used for the AES encryption scheme. This means that every installation of the affected software prior to version 16.12.10420.56791 uses identical cryptographic keys, rendering the encryption effectively meaningless once the key values are known.
CVSS Vector Breakdown: The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector reflects near-maximum severity. Attack Vector (AV:N) indicates remote exploitation over the network. Attack Complexity (AC:L) means no special conditions are required beyond knowing the hard-coded key values. Privileges Required (PR:N) confirms no authentication is needed. User Interaction (UI:N) means no legitimate user action is required. Scope (S:U) is unchanged. Confidentiality, Integrity, and Availability (C:H/I:H/A:H) are all maximally impacted.
Attack Mechanism: The vulnerability allows an attacker to craft specially formed requests to publicly exposed endpoints of CentreStack or Triofox. Because the AES encryption keys are hard-coded and identical across all installations, the attacker can encrypt request parameters using the known keys to construct requests that the application accepts as legitimate. This enables arbitrary local file inclusion, allowing the attacker to read any file on the server that the application process has access to. The file inclusion capability can be leveraged to extract sensitive configuration data, database credentials, and potentially achieve remote code execution through further exploitation techniques. The hard-coded nature of the credentials means that no per-instance secret discovery is needed; once the vulnerability is understood, every unpatched installation is equally vulnerable.
Frequently Asked Questions
What is the root cause of CVE-2025-14611?
The root cause is the use of hard-coded values in the AES cryptographic implementation of Gladinet CentreStack and Triofox. Every installation prior to version 16.12.10420.56791 uses the same cryptographic keys, allowing attackers who know these values to bypass encryption-based security controls.
Is CVE-2025-14611 being actively exploited?
Yes, extensively. The vulnerability has an EPSS score of 0.58283 (98.1st percentile), indicating it is among the most heavily exploited CVEs currently tracked. Huntress has documented active exploitation campaigns, and CISA has listed it in the KEV catalog with a January 5, 2026 remediation deadline.
Which products and versions are affected?
Gladinet CentreStack and Gladinet Triofox versions prior to 16.12.10420.56791 are both affected. Both products share the same vulnerable cryptographic implementation and require the same update to remediate.
What can an attacker do by exploiting CVE-2025-14611?
An attacker can achieve arbitrary local file inclusion on the server, allowing them to read sensitive files including configuration data, database credentials, and user information. This can serve as a stepping stone for further exploitation including potential remote code execution and lateral movement within the network.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.