CVE-2025-11371

Published Oct 9, 2025

Last updated a month ago

Gladinet CentreStack

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-11371 is an unauthenticated local file inclusion vulnerability found in Gladinet CentreStack and TrioFox. It exists in the default installation and configuration of these applications. The vulnerability allows attackers to read sensitive system files without authentication. Exploitation of this vulnerability has been observed in the wild. The vulnerability impacts all versions of Gladinet CentreStack and TrioFox up to and including 16.7.10368.56560. By exploiting this flaw, a threat actor can retrieve the machine key from the application's Web.config file. This key can then be used to perform remote code execution via a ViewState deserialization vulnerability.

Description: In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Source: 5dacb0b8-2277-4717-899c-254586fe4912
NVD status: Analyzed
Products: centrestack, triofox

Insights

Analysis from the Intruder Security Team

Published Oct 13, 2025 Updated Oct 13, 2025

Note that the public CVSS score for this vulnerability is too low - it has been scored as if it was a local vulnerability, when it can be exploited remotely.

This vulnerability is essentially a remote code execution vulnerability, as an attacker can use the LFI to obtain the Machine Key for the installation and then leverage this in the same way as a previous vulnerability discovered earlier in the year.

Attackers have knowledge of how to exploit this and there is no patch currently available. If you have an exposed instance, you must apply the mitigation discussed by Huntress in their post and consider that the server may be compromised.

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Exploit added on: Nov 4, 2025
Exploit action due: Nov 25, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-552

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E558139A-6A80-4BAA-8786-15E5AFCA9C37",
            "versionEndExcluding": "16.10.10408.56683"
          },
          {
            "criteria": "cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A8D9B616-FF33-4FF0-A97C-4C0B134E7B40",
            "versionEndIncluding": "16.7.10368.56560"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.