CVE-2025-14611

🗓️ 12 Dec 2025 21:01:13Reported by HuntressType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 38 Views🌐 WEB

Hardcoded AES keys in Gladinet and TrioFox before 16.12.10420.56791 enable unauthenticated access.

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for Use of Hard-coded Credentials in Gladinet Centrestack	29 Dec 202511:21	–	githubexploit
ATTACKERKB	CVE-2025-14611	12 Dec 202521:01	–	attackerkb
Circl	CVE-2025-14611	12 Dec 202521:27	–	circl
CISA KEV Catalog	Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability	15 Dec 202500:00	–	cisa_kev
CISA	CISA Adds Two Known Exploited Vulnerabilities to Catalog	15 Dec 202512:00	–	cisa
CNNVD	Gladinet CentreStack 安全漏洞	12 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-14611 Gladinet CentreStack and TrioFox Hard Coded AES Keys	12 Dec 202521:01	–	cvelist
EUVD	EUVD-2025-203165	12 Dec 202521:01	–	euvd
Metasploit	Gladinet CentreStack/Triofox Access Ticket Forge	4 Feb 202618:58	–	metasploit
Nuclei	Gladinet CentreStack & Triofox - Hardcoded Credentials	4 Feb 202607:00	–	nuclei

NVD

Node

gladinet centrestackRange<16.12.10420.56791

gladinet triofoxRange<16.12.10420.56791

[
  {
    "defaultStatus": "unaffected",
    "product": "CentreStack and TrioFox",
    "vendor": "Gladinet",
    "versions": [
      {
        "lessThan": "16.12.10420.56791",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
huntress	www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
t	query param	/storage/filesvr.dn	CentreStack access ticket endpoint vulnerable to forged tickets for arbitrary file read	CWE-798
t	query param	/servlets/filesvr.dn	Triofox access ticket endpoint vulnerable to forged tickets for arbitrary file read	CWE-798

17 Jun 2026 08:36Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.19.8

CVSS 47.1

EPSS0.50949

SSVC