Gladinet CentreStack and Triofox Unauthenticated Local File Inclusion (LFI) Vulnerability (CVE-2025-11371) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAll versions of Gladinet CentreStack and Triofox prior to and including 16.7.10368.56560
Unauthenticated remote attackers can exploit this flaw to read sensitive system and configuration files, leading to critical information disclosure
Immediately upgrade to the patched version (16.7.10368.56561 or higher) and restrict external access to the management console
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Refer to the official Gladinet release notes and upgrade your installation to version 16.7.10368.56561 or later immediately.
# Check the status of CentreStack/Triofox services and prepare for update
Get-Service -Name 'CentreStack*' | Format-Table -Autosize
# It is highly recommended to download the latest installer from the official portal (https://www.centrestack.com/p/gce_latest_release.html) and perform an in-place upgrade.2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, implement URL rewrite rules in IIS to block directory traversal patterns and restrict access to the application from untrusted networks.
<!-- Add this rewrite rule inside the <system.webServer> section of your web.config to block traversal attempts -->
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name='Block_LFI_Traversals' stopProcessing='true'>
<match url='.*' />
<conditions>
<add input='{QUERY_STRING}' pattern='(\.\./|\.\.\\)' />
</conditions>
<action type='CustomResponse' statusCode='403' statusReason='Forbidden' statusDescription='Access Denied' />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>3. Log Audit & IoC Verification Commands
Use the following PowerShell script to scan IIS W3C logs for potential directory traversal attempts and unauthorized access to sensitive files.
# Scan IIS logs for directory traversal patterns and sensitive file access
$LogPath = 'C:\inetpub\logs\LogFiles\W3SVC1\*'
Select-String -Path $LogPath -Pattern '\.\./', '\.\.\\', 'web.config' |
Select-Object Path, LineNumber, Line |
Export-Csv -Path 'C: emp\LFI_Detection_Results.csv' -NoTypeInformation
Write-Host 'IIS log analysis complete. Results saved to C: emp\LFI_Detection_Results.csv' -ForegroundColor GreenBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-11371) is an unauthenticated Local File Inclusion (LFI) flaw residing in the default installation and configuration of Gladinet CentreStack and Triofox. The root cause is the lack of proper input validation and sanitization of user-supplied file paths (CWE-552), allowing attackers to bypass directory restrictions and access files outside the intended web root.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can craft malicious HTTP requests containing directory traversal sequences (e.g., ../../) targeting vulnerable endpoints. Because the application processes these paths without adequate validation, it retrieves and returns the contents of arbitrary local files. This allows attackers to extract sensitive configuration files, such as web.config, database credentials, and system configuration files.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog. With an EPSS score of 0.9214 (92.14%), the likelihood of exploitation is extremely high. Successful exploitation can lead to the exposure of administrative credentials, enabling subsequent lateral movement, full infrastructure compromise, and severe business disruption.
Official Vendor Advisories & References
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Frequently Asked SecOps Questions (CVE-2025-11371)
FAQQ1. How critical is CVE-2025-11371 and is it actively exploited in the wild?
CVE-2025-11371 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 92.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-11371?
Primary impacted vendors include gladinet across centrestack, triofox. Scope summary: Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Q3. What temporary mitigations or workarounds exist for CVE-2025-11371 before patching?
[Mitigation] Immediately upgrade to the patched version (16.7.10368.56561 or higher) and restrict external access to the management console Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-11371
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gladinet)
View Category →Atlassian Data Center Arbitrary File Access Vulnerability Advisory (CVE-2026-21589)
[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.