Hackers Exploit Critical Flaw in Triofox File Sharing Product
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-11371 | Unauthenticated Local File Inclusion in Gladinet CentreStack and Triofox Gladinet CentreStack and Triofox, in their default installation and configuration, contain an unauthenticated local file inclusion flaw (CWE-552) that allows unintended disclosure of system files to remote attackers. The flaw requires no privileges or user interaction (CVSS 3.1: AV:N/PR:N/UI:N, 7.5 High), so any internet-facing deployment is directly reachable over the network. An attacker gains access to system files that should not be externally readable, and related reporting indicates active attacks have chained the flaw — including with Gladinet's hardcoded keys — toward unauthorized access, code execution, and deployment of remote access tools. All versions prior to and including 16.7.10368.56560 of both products are affected. Exploitation has been observed in the wild: the vulnerability was added to CISA's KEV on 2025-11-04 and carries a 92.1% EPSS probability of exploitation within 30 days. Do: Upgrade CentreStack and Triofox to a release newer than 16.7.10368.56560, and apply vendor mitigations per CISA BOD 22-01 requirements (federal agencies must mitigate or discontinue use of affected versions). Until patched, restrict internet exposure of the service and review logs for suspicious unauthenticated requests, unexpected file reads, new accounts, or signs of follow-on compromise such as remote-access tool installation. The Huntress write-up referenced in this record provides exploitation context for detection guidance; no exploit code is required to confirm patch status. | 7.5 | 92% | KEV PoC |
| moderate≈ thousands (10^3–10^4) of internet-facing CentreStack/Triofox server deployments; exact counts unknown | |
| CVE-2025-12480 | Improper Access Control in Gladinet Triofox Exploited in the Wild Gladinet Triofox versions prior to 16.7.10368.56560 contain an improper access control flaw (CWE-284) that leaves the product's initial setup pages reachable without authentication even after initial configuration is complete. Because the flaw requires no privileges, user interaction, or special conditions (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), a remote attacker can reach these setup pages on an internet-reachable Triofox server. By re-entering the setup flow, an attacker can reconfigure the deployment, and public reporting indicates attackers abused this to run malicious payloads via the antivirus configuration feature and install remote access tools, producing high confidentiality and integrity impact (C:H/I:H/A:N). Any organization running an affected Triofox version, whether deployed on-premises or as a cloud service, is exposed. The flaw is being actively exploited: Google/Mandiant published a public technical writeup, CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-12, and EPSS puts the 30-day exploitation probability at 90.5% (100th percentile). Do: Upgrade Triofox to version 16.7.10368.56560 or later per vendor instructions; where patching is not immediately possible, apply vendor mitigations, restrict access to the setup pages, and note that federal agencies must follow CISA BOD 22-01 guidance (including for cloud services) or discontinue use. Given confirmed in-the-wild exploitation, check for compromise: review the antivirus configuration for tampering, hunt for installed remote access tools or unexpected payloads, and audit accounts and configuration changes made after initial setup. | 9.1 | 91% | KEV PoC |
| moderateorder of a few thousand internet-facing Triofox deployments (est.), plausibly serving tens of thousands of users |
Full article686 words · extracted from infosecurity-magazine.com · click to collapse
Cyber threat actors have been exploiting a vulnerability in Gladinet’s Triofox, a file-sharing and remote access platform, and chained it with the abuse of the built-in anti-virus feature to achieve code execution.
The threat activity cluster conducting the exploit is tracked as UNC6485 by Google’s Mandiant Threat Defense and Google Threat Intelligence Group (GTIG), according to a new report published on November 10.
The vulnerability, CVE-2025-12480, was discovered and reported by Mandiant on November 10. It is a critical improper access control flaw (CVSS: 9.8) affecting Triofox versions prior to 16.7.10368.56560.
When exploited, it allows an attacker to gain access to initial setup pages even after setup is complete, enabling the upload and execution of arbitrary payloads.
Google contacted Gladinet before disclosing the vulnerability.
The tech giant confirmed that the software owner released a patched version of Triofox, 16.7.10368.56560, in June.
However, the exploitation campaign started in August, with UNC6485 exploiting CVE-2025-12480 on older versions of Triofox.
How UNC64485 Exploited CVE-2025-12480
Mandiant detected the malicious campaign while responding to a security incident and assessed that it started on August 14, 2025.
The researchers identified an anomalous entry in the HTTP log file – a localhost host header – which they described as “highly irregular” in a request originating from an external source and “typically not expected in legitimate traffic.”
“The investigation revealed an unauthenticated access vulnerability that allowed access to configuration pages. UNC6485 used these pages to run the initial Triofox setup process to create a new native admin account, Cluster Admin, and used this account to conduct subsequent activities,” wrote the Mandiant and GTIG researchers in the report.
Mandiant discovered that attackers exploited an HTTP Host header vulnerability by spoofing localhost in requests, bypassing access controls to reach the normally restricted AdminDatabase.aspx setup page.
By abusing this misconfiguration, where the CanRunCriticalPage() function relied solely on the unvalidated host header, they triggered the Triofox initialization process, creating a new native ‘Cluster Admin’ account with full privileges.
The flaw stemmed from missing origin validation and over-reliance on the host header, allowing unauthenticated remote access to critical configuration pages.
To achieve code execution, the attackers logged in using the newly created Admin account and uploaded malicious files to execute them using the built-in anti-virus feature.
To set up the anti-virus feature, the user is allowed to provide an arbitrary path for the selected anti-virus. The file configured as the anti-virus scanner location inherits the Triofox parent process account privileges, running under the context of the SYSTEM account.
The attackers were able to run their malicious batch script by configuring the path of the anti-virus engine to point to their script.
Then, by uploading an arbitrary file to any published share within the Triofox instance, the configured script will be executed.
After gaining initial access, the attackers deployed a disguised Zoho Unified Endpoint Management System (UEMS) installer via PowerShell to drop Zoho Assist and AnyDesk for remote control.
The attackers then used these tools to enumerate Server Message Block (SMB) sessions, escalate privileges by modifying domain/admin group memberships and exfiltrate credentials.
For persistence and evasion, they established an SSH tunnel via Plink/PuTTY to their command-and-control (C2) server, enabling covert remote desktop protocol (RDP) access over port 433 while masking traffic as legitimate remote management activity.
Upgrade Triofox, Audit Admin Accounts and Hunt for Attacker Tools
While the CVE-2025-12480 vulnerability has been patched since June, the malicious campaign identified by Mandiant shows evidence that threat actors were exploiting unpatched Triofox versions in August.
Therefore, the GTIG report urged Triofox users not only to upgrade to the latest release but also recommended auditing admin accounts and verifying that Triofox’s Anti-virus Engine is not configured to execute unauthorized scripts or binaries.
“Security teams should also hunt for attacker tools using our hunting queries listed at the bottom of this post and monitor for anomalous outbound SSH traffic,” the report concluded.
Another vulnerability affecting Triofox, tracked as CVE-2025-11371, was recently added to the US Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/hackers-exploit-critical-flaw/