Vulnerabilities

Gladinet CentreStack and Triofox versions prior to 16.12.10420.56791 use hardcoded values for their AES cryptoscheme implementation (CWE-798), meaning affected deployments share fixed encryption keys. Because the keys are static, an unauthenticated attacker who sends a specially crafted request to an affected, publicly exposed endpoint can degrade or bypass the cryptographic protections and achieve arbitrary local file inclusion. An attacker gains unauthorized access to protected data, and the flaw can be leveraged on its own or chained with previously disclosed vulnerabilities to achieve code execution and full system compromise. Any organization running self-hosted or MSP-hosted CentreStack or Triofox gateways exposed to the internet is affected. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-15, Huntress has published public proof-of-concept details with observed attacks, and EPSS estimates a 53.3% probability of exploitation within 30 days.

Do: Upgrade CentreStack and Triofox to version 16.12.10420.56791 or later per vendor instructions; per CISA KEV/BOD 22-01 guidance, apply vendor mitigations promptly or discontinue use of the product if mitigations are unavailable. Because the hardcoded cryptographic values cannot be rotated by administrators, prioritize patching internet-facing instances and review logs for unauthenticated, specially crafted requests and signs of unauthorized access.

Gladinet Triofox versions prior to 16.7.10368.56560 contain an improper access control flaw (CWE-284) that leaves the product's initial setup pages reachable without authentication even after initial configuration is complete. Because the flaw requires no privileges, user interaction, or special conditions (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), a remote attacker can reach these setup pages on an internet-reachable Triofox server. By re-entering the setup flow, an attacker can reconfigure the deployment, and public reporting indicates attackers abused this to run malicious payloads via the antivirus configuration feature and install remote access tools, producing high confidentiality and integrity impact (C:H/I:H/A:N). Any organization running an affected Triofox version, whether deployed on-premises or as a cloud service, is exposed. The flaw is being actively exploited: Google/Mandiant published a public technical writeup, CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-12, and EPSS puts the 30-day exploitation probability at 90.5% (100th percentile).

Do: Upgrade Triofox to version 16.7.10368.56560 or later per vendor instructions; where patching is not immediately possible, apply vendor mitigations, restrict access to the setup pages, and note that federal agencies must follow CISA BOD 22-01 guidance (including for cloud services) or discontinue use. Given confirmed in-the-wild exploitation, check for compromise: review the antivirus configuration for tampering, hunt for installed remote access tools or unexpected payloads, and audit accounts and configuration changes made after initial setup.

Gladinet CentreStack and Triofox, in their default installation and configuration, contain an unauthenticated local file inclusion flaw (CWE-552) that allows unintended disclosure of system files to remote attackers. The flaw requires no privileges or user interaction (CVSS 3.1: AV:N/PR:N/UI:N, 7.5 High), so any internet-facing deployment is directly reachable over the network. An attacker gains access to system files that should not be externally readable, and related reporting indicates active attacks have chained the flaw — including with Gladinet's hardcoded keys — toward unauthorized access, code execution, and deployment of remote access tools. All versions prior to and including 16.7.10368.56560 of both products are affected. Exploitation has been observed in the wild: the vulnerability was added to CISA's KEV on 2025-11-04 and carries a 92.1% EPSS probability of exploitation within 30 days.

Do: Upgrade CentreStack and Triofox to a release newer than 16.7.10368.56560, and apply vendor mitigations per CISA BOD 22-01 requirements (federal agencies must mitigate or discontinue use of affected versions). Until patched, restrict internet exposure of the service and review logs for suspicious unauthenticated requests, unexpected file reads, new accounts, or signs of follow-on compromise such as remote-access tool installation. The Huntress write-up referenced in this record provides exploitation context for detection guidance; no exploit code is required to confirm patch status.

Gladinet CentreStack (and, per CISA, the companion product Triofox) ships with a hard-coded ASP.NET machineKey in the portal's web.config, which is used to protect ViewState and similar serialized data. An attacker who knows this fixed key can craft a serialized payload and submit it to the network-facing portal, where server-side deserialization executes it, yielding unauthenticated remote code execution (CVSS 9.8, no privileges or user interaction required). Successful RCE gives attackers full control of the file-sharing server (high confidentiality, integrity and availability impact); public reporting indicates attackers have abused the flaw to gain unauthorized access and install remote access tools. Anyone running the affected CentreStack builds is exposed, with self-hosted deployments at SMBs and MSP-hosted environments the typical footprint. The flaw was exploited in the wild in March 2025, was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-08, and carries an EPSS of 94.3% (100th percentile).

Do: Upgrade CentreStack to 16.4.10315.56368 or later, and apply the equivalent vendor fix for Triofox; as an interim mitigation, administrators can delete the hard-coded machineKey defined in portal\web.config so it is regenerated. Because the flaw is actively exploited, review portals for signs of compromise (unexpected accounts, unfamiliar processes or remote access tools) and, for federal agencies, follow the applicable BOD 22-01 required actions.

An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user account, without needing the previous known password, resulting in a full authentication bypass.