Triofox - Improper Access Control

Exploited in the wild. Listed by CISA on 2025-11-12; known to be used by ransomware.

criticalseverity

9.8CVSS score

95.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely access, view, and potentially interact with the database management interface, risking data disclosure or system compromise.

Impact

Attackers may gain access to sensitive administrative functions of the Triofox database, resulting in unauthorized data access, modification, or potential system compromise.

Fix

Upgrade to Triofox 12.91.1126.65588 or CentreStack 12.10.595.65696 and later to resolve this vulnerability and restrict unauthenticated access to the administrative database panel.

How to confirm it

Send: GET /management/admindatabase.aspx
Positive when: contains "Triofox Enterprise" and "Manage Database" and "Configure Database" AND status 200

Run it with nuclei: nuclei -id CVE-2025-12480 -u <target>

The full check

id: CVE-2025-12480

info:
  name: Triofox - Improper Access Control
  author: johnk3r,gti
  severity: critical
  description: |
    The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely access, view, and potentially interact with the database management interface, risking data disclosure or system compromise.
  impact: |
    Attackers may gain access to sensitive administrative functions of the Triofox database, resulting in unauthorized data access, modification, or potential system compromise.
  remediation: |
    Upgrade to Triofox 12.91.1126.65588 or CentreStack 12.10.595.65696 and later to resolve this vulnerability and restrict unauthenticated access to the administrative database panel.
  reference:
    - https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480
    - https://attackerkb.com/topics/5C4wRy6hY7/cve-2025-12480/rapid7-analysis
    - https://nvd.nist.gov/vuln/detail/CVE-2025-12480
  classification:
    cve-id: CVE-2025-12480
    epss-score: 0.95748
    epss-percentile: 0.99872
    cwe-id: CWE-306
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-177043778
    fofa-query: icon_hash="-177043778"
  tags: cve,cve2025,triofox,unauth,exposure,vkev,kev,vuln

http:
  - raw:
      - |
        GET /management/admindatabase.aspx HTTP/1.1
        Host: localhost

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Triofox Enterprise'
          - 'Manage Database'
          - 'Configure Database'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from