Gladinet Triofox Improper Access Control (CVE-2025-12480)

#%NASL_MIN_LEVEL 80900
##
# Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(276656);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/04");

  script_cve_id("CVE-2025-12480");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/12/03");

  script_name(english:"Gladinet Triofox Improper Access Control (CVE-2025-12480)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Gladinet Triofox prior to version 16.7.10368.56560. It is, therefore, are vulnerable to an 
Improper Access Control flaw.

This vulnerability in Gladinet’s Triofox (versions before 16.7.10368.56560) that lets unauthenticated attackers 
bypass authentication (via a host-header spoof to “localhost”), access initial setup/admin configuration pages, 
create their own admin account, and ultimately abuse Triofox’s built-in antivirus feature to upload and run 
arbitrary code as SYSTEM.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fb82fb11");
  # https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-12480
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1f671c12");
  script_set_attribute(attribute:"solution", value:
"Update Gladinet Triofox to version 16.7.10368.56560 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-12480");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:gladinet:triofox");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("gladinet_triofox_win_installed.nbin");
  script_require_keys("installed_sw/Gladinet Triofox");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "windows"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Gladinet Triofox",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "16.7.10368.56560"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);