CVE-2025-14611: Gladinet CentreStack & Triofox hard-coded crypto, actively exploited
The short version: Gladinet CentreStack and Triofox used hard-coded values in their AES cryptographic scheme (CVE-2025-14611). Because the secret isn't secret, an unauthenticated attacker can craft a request that yields arbitrary local file inclusion on the server. It's under active exploitation and listed in CISA's KEV catalog. Patch and confirm your exposure. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — actively exploited access appliance |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS v4.0 (NVD) | 7.1 — High |
| EPSS | ~50.95% · 98th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2026-01-05 |
| Known exploited? | Yes — active exploitation reported (Huntress) |
| Vulnerability type | CWE-798 use of hard-coded credentials → unauthenticated arbitrary local file inclusion |
| Requires authenticated session? | No — pre-authentication |
| Affected | Gladinet CentreStack and Triofox before 16.12.10420.56791 |
| Fixed in | 16.12.10420.56791 |
What you need to know
CentreStack and Triofox used hard-coded values in their implementation of AES. When a cryptographic secret is baked into the product, it's the same for every deployment — so an attacker who knows it can forge the values the application trusts. Here, a specially crafted, unauthenticated request abuses that to achieve arbitrary local file inclusion, pulling files off the server that should never be reachable.
Why it's worth prioritizing:
- It's an internet-facing file-access platform. These servers front sensitive documents and remote access, so file disclosure on the host is high-impact.
- It's pre-authentication. The hard-coded secret means no login is required.
- It's already being exploited. Huntress reported active exploitation; CISA added it to KEV with a deadline that has passed.
How serious we see it
High — in practice.
Hard-coded cryptographic material on an internet-facing access appliance, abused without authentication and confirmed exploited in the wild, earns a top-of-queue rating regardless of which CVSS box each metric lands in. (NVD's v3.1 scores it 9.8 and its newer v4.0 scoring lands at 7.1 — we rate by real-world impact and KEV status.) The bounded, reassuring part is that specific builds are affected, the fix is out, and exposure is quick to confirm.
Recommendations
Straight from the vendor guidance and CISA:
- Patch now. Upgrade CentreStack and Triofox to 16.12.10420.56791 or later.
- Rotate secrets and hunt. Because the flaw is a hard-coded crypto key, assume anything the key protected may be exposed — rotate credentials and review logs for suspicious file-access requests.
- If you find indicators, respond fully. Investigate for lateral movement and further compromise.
- Restrict exposure. Limit who can reach these interfaces from the internet.
- Confirm your exposure first. Verify whether you run an affected CentreStack or Triofox build.
How BreachRisk sees it
BreachRisk discovers internet-facing CentreStack and Triofox interfaces from little more than your domain, fingerprints the build, and flags exposure tied to this KEV-listed, actively exploited CVE — surfaced at the top of your results because it's in KEV. We detect and flag the exposed, affected version so it doesn't get lost in a scanner backlog.
That continuous, outside-in view means the exposed appliance is already mapped when a flaw like this breaks — so you go straight to patch-and-verify.