Home / Vulnerabilities / CVE-2025-14611
CRITICAL SEVERITY
CVE-2025-14611 Gladinet · CentreStack and Triofox

Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Technical Severity

CVSS v3.1 Metrics

CRITICAL
9.8 / 10
Minimal Risk Critical
Vector Specification
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Likelihood

EPSS Prediction

59.14 %
Predictive Probability
Percentile Rank
98.2 th

Documented as more likely to be exploited than 98.2% of known CVEs.

Detection Date

Dec 15, 2025

Remediation Due

Jan 05, 2026

CISA Catalog Active

Threat Analysis

Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.

Remediation Directive

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://www.centrestack.com/p/gce_latest_release.html

https://www.centrestack.com/p/gce_latest_release.html

https://access.triofox.com/releases_history/

https://access.triofox.com/releases_history/

https://support.centrestack.com/hc/en-us/articles/360007159054-Hardening-the-CentreStack-Cluster#h_01JQRV57T37HJFQZKBZH9NBXQP

https://support.centrestack.com/hc/en-us/articles/360007159054-Hardening-the-CentreStack-Cluster#h_01JQRV57T37HJFQZKBZH9NBXQP
NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-14611