CVE-2025-12480

Published Nov 10, 2025

Last updated 2 months ago

Triofox

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-12480 is an improper access control vulnerability affecting Triofox versions prior to 16.7.10368.56560. It allows unauthorized access to the initial setup pages even after the setup is complete. Attackers can bypass authentication and access configuration pages, potentially uploading and executing arbitrary payloads. In one observed case, a threat actor (UNC6485) exploited this vulnerability to create a new admin account and then used the built-in antivirus feature to execute malicious files. To remediate this vulnerability, it is recommended to upgrade to Triofox version 16.7.10368.56560 or later.

Description: Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
Source: mandiant-cve@google.com
NVD status: Analyzed
Products: triofox

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Gladinet Triofox Improper Access Control Vulnerability
Exploit added on: Nov 12, 2025
Exploit action due: Dec 3, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

mandiant-cve@google.com: CWE-284

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gladinet:triofox:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "85D1B442-0354-472A-9A4C-1417AAE16936",
            "versionEndExcluding": "16.7.10368.56560"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.