CVE-2025-14611

Gladinet CentreStack and Triofox versions prior to 16.12.10420.56791 use hardcoded values for their AES cryptoscheme implementation (CWE-798), meaning affected deployments share fixed encryption keys. Because the keys are static, an unauthenticated attacker who sends a specially crafted request to an affected, publicly exposed endpoint can degrade or bypass the cryptographic protections and achieve arbitrary local file inclusion. An attacker gains unauthorized access to protected data, and the flaw can be leveraged on its own or chained with previously disclosed vulnerabilities to achieve code execution and full system compromise. Any organization running self-hosted or MSP-hosted CentreStack or Triofox gateways exposed to the internet is affected. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-15, Huntress has published public proof-of-concept details with observed attacks, and EPSS estimates a 53.3% probability of exploitation within 30 days.

What to do: Upgrade CentreStack and Triofox to version 16.12.10420.56791 or later per vendor instructions; per CISA KEV/BOD 22-01 guidance, apply vendor mitigations promptly or discontinue use of the product if mitigations are unavailable. Because the hardcoded cryptographic values cannot be rotated by administrators, prioritize patching internet-facing instances and review logs for unauthenticated, specially crafted requests and signs of unauthorized access.