CVE-2025-11371

Published Oct 9, 2025

Last updated 4 months ago

Exploit known CVSS high 7.5

Gladinet CentreStack

Overview

Description: In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Source: 5dacb0b8-2277-4717-899c-254586fe4912
NVD status: Analyzed
Products: centrestack, triofox

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Exploit added on: Nov 4, 2025
Exploit action due: Nov 25, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-552

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E558139A-6A80-4BAA-8786-15E5AFCA9C37",
            "versionEndExcluding": "16.10.10408.56683",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A8D9B616-FF33-4FF0-A97C-4C0B134E7B40",
            "versionEndIncluding": "16.7.10368.56560",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References