In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. 

This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.05145.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Gladinet
  • Centrestack

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Gladinet
  • Centrestack
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

If you currently utilize either CentreStack or TrioFox, please check your inbox for communication from Gladinet regarding a temporary mitigation while a patch is being developed.

References
Link Providers
https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw cve-icon cve-icon
History

Mon, 03 Nov 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Oct 2025 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-220

Fri, 10 Oct 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-552
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

 cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Fri, 10 Oct 2025 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Gladinet
Gladinet centrestack
Vendors & Products Gladinet
Gladinet centrestack

Thu, 09 Oct 2025 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-220
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Oct 2025 17:00:00 +0000

Type Values Removed Values Added
Description In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Title Gladinet CentreStack and TrioFox Local File Inclusion Flaw
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Huntress

Published:

Updated: 2025-11-04T04:55:23.879Z

Reserved: 2025-10-06T14:00:55.234Z

Link: CVE-2025-11371

cve-icon Vulnrichment

Updated: 2025-10-09T19:16:17.783Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-09T17:15:58.507

Modified: 2025-11-03T19:15:46.543

Link: CVE-2025-11371

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-10-10T11:17:45Z