CVE-2025-14611 kev in the critical feed json
Gladinet CentreStack and TrioFox Hard Coded AES Keys
published 10mo ago modified last mo. also EUVD-2025-203165
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Exploited
- added 2025-12-15
- epss
- 53.3%
- EPSS 53.3% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Metasploit
Summary
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
Patch / fix
cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Gladinet CentreStack and TrioFox 16.12.10420.56791
Is CVE-2025-14611 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (Metasploit auxiliary/gather/gladinet_storage_access_ticket_forge)
- Published
- Added to CISA KEV
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 10mo ago
- Patch by
- 2026-01-05 (10mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Gladinet, CentreStack and Triofox
- CISA name
- Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
Ransomware
Groups reported to have exploited it in intrusions.
- Storm-2603 (Warlock) ransomware gang
reported by linkedin.com
Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 10mo ago
Exploit prediction
53.30% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- Metasploit auxiliary/gather/gladinet_storage_access_ticket_forge Gladinet CentreStack/Triofox Access Ticket Forge metasploit auxiliary, normal rank, 2025-12-10
- huntress.com https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Gladinet CentreStack and TrioFox
Classification
- Weakness
-
- CWE-798 Use of Hard-coded Credentials
References
-
huntress.com
/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
exploit, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14611
government-resource, us-government-resource
Sources
- CVE List CVE-2025-14611
- NVD CVE-2025-14611
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.