A bug in the Gladinet Triofox system causes the WOSCommonUtil.dll function WOSSysInfoGetDeviceInterface() to return a NULL pointer when no user is logged into the Server Agent Management Console. The code does not verify the pointer before dereferencing it, which leads to a crash of the affected DLL and results in a denial of service. The weakness involved is a null pointer dereference, identified as CWE-476, and the impact is the loss of availability of the Triofox service.

The vulnerability affects installations of the Gladinet Triofox Server Agent Management Console that use the WOSPhysicalProfile Manager Module or the WOSWebDav Module, which in turn invoke the WOSCommonUtil.dll library. Versions are not specified in the advisory; the flaw applies to any release that incorporates these modules.

The CVSS score of 7.5 indicates a high severity level, but the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. The likely attack vector is local or via privileged access to the console, as the crash occurs when no user session is active. While no detailed exploitation chain is disclosed, a successful trigger would cause the Triofox service to terminate and require manual restart, leading to significant downtime.