Gladinet CentreStack and TrioFox Local File Inclusion Flaw
Summary
| CVE | CVE-2025-11371 |
|---|---|
| State | PUBLISHED |
| Assigner | Huntress |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-09 17:15:58 UTC |
| Updated | 2026-10-08 13:10:00 UTC |
| Description | In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560 |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.921370000 probability, percentile 0.998230000 (date 2026-10-21)
CISA KEV: Listed on 2025-11-04; due 2025-11-25; ransomware use Unknown
Problem Types: CWE-552 | CWE-552 CWE-552 Files or Directories Accessible to External Parties
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA Known Exploited Vulnerability
| Vendor | Gladinet |
|---|---|
| Product | CentreStack and Triofox |
| Name | Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability |
| Required Action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
| Notes | https://www.centrestack.com/p/gce_latest_release.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-11371 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Gladinet | Centrestack | All | All | All | All |
| Application | Gladinet | Triofox | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Gladinet | CentreStack And TrioFox | affected 16.7.10368.56560 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw | 5dacb0b8-2277-4717-899c-254586fe4912 | www.huntress.com | Exploit, Third Party Advisory |
| www.centrestack.com/p/gce_latest_release.html | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.centrestack.com | Release Notes |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
Vendor Comments And Credit
Discovery Credit
CNA: Bryan Masters (en)
CNA: James Maclachlan (en)
CNA: Jai Minton (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2025-11-04T00:00:00.000Z | CVE-2025-11371 added to CISA KEV |
Workarounds
CNA: If you currently utilize either CentreStack or TrioFox, please check your inbox for communication from Gladinet regarding a temporary mitigation while a patch is being developed.
There are currently no legacy QID mappings associated with this CVE.