Gladinet CentreStack and Triofox Hardcoded Cryptographic Key Arbitrary Local File Inclusion (LFI) Vulnerability (CVE-2025-14611) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTGladinet CentreStack and Triofox solutions prior to version 16.12.10420.56791
Unauthenticated remote attackers can exploit hardcoded AES keys to read arbitrary local files and potentially achieve full system compromise
Immediately upgrade to version 16.12.10420.56791 or later and restrict access to publicly exposed endpoints
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Immediately upgrade Gladinet CentreStack or Triofox to version 16.12.10420.56791 or higher. Use the following PowerShell script to verify the installed version on Windows Server environments.
# PowerShell script to check installed CentreStack/Triofox version
$registryPath = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
Get-ItemProperty -Path $registryPath |
Where-Object { $_.DisplayName -like '*CentreStack*' -or $_.DisplayName -like '*Triofox*' } |
Select-Object DisplayName, DisplayVersion2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict external access to the application endpoints using IIS URL Rewrite rules to block directory traversal patterns.
<!-- Example IIS URL Rewrite Rule to block directory traversal patterns -->
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name='Block Directory Traversal' stopProcessing='true'>
<match url='.*' />
<conditions logicalGrouping='MatchAny'>
<add input='{QUERY_STRING}' pattern='(\.\./|\.\.\\)' />
<add input='{REQUEST_URI}' pattern='(\.\./|\.\.\\)' />
</conditions>
<action type='CustomResponse' statusCode='403' statusReason='Forbidden' />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>3. Log Audit & IoC Verification Commands
Inspect web server access logs for suspicious requests containing directory traversal sequences or unusual encrypted parameters.
# Scan web server logs for potential LFI exploitation attempts
grep -Ei '(\.\./|\.\.\\|win\.ini|/etc/passwd)' /var/log/nginx/access.log || echo 'No suspicious LFI patterns detected.'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-14611) exists in Gladinet CentreStack and Triofox due to the use of hardcoded cryptographic keys (CWE-798) within their implementation of the AES encryption scheme. Because the encryption mechanism relies on static, hardcoded values, the security of publicly exposed endpoints utilizing this scheme is severely degraded.
2. Exploitation Mechanics & Attack Scenario
An attacker can extract the hardcoded AES keys via reverse engineering and craft a malicious payload containing arbitrary file paths. By encrypting this payload with the static key and sending it to the vulnerable endpoint, the server decrypts and processes the request without proper authentication or validation. This leads to arbitrary Local File Inclusion (LFI), allowing the attacker to read sensitive system files and potentially chain this with other vectors to achieve Remote Code Execution (RCE).
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat. Successful exploitation can lead to the exposure of database credentials, configuration files, and Active Directory integration details, resulting in lateral movement and complete infrastructure compromise.
Official Vendor Advisories & References
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
Frequently Asked SecOps Questions (CVE-2025-14611)
FAQQ1. How critical is CVE-2025-14611 and is it actively exploited in the wild?
CVE-2025-14611 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 53.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-14611?
Primary impacted vendors include gladinet across centrestack, triofox. Scope summary: All versions of Gladinet CentreStack and Triofox prior to 16.12.10420.56791
Q3. What temporary mitigations or workarounds exist for CVE-2025-14611 before patching?
[Mitigation] Immediately upgrade to version 16.12.10420.56791 or later and restrict access to publicly exposed endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-14611
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gladinet)
View Category →Dell RecoverPoint for Virtual Machines Hardcoded Credentials Vulnerability (CVE-2026-22769) Security Advisory
[Affected Scope] Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.