CVE-2025-11371 kev in the critical feed json
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
published 2025-10-09 13 mo ago modified 2026-10-08 32 d ago also EUVD-2025-33408
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Exploited
- added 2025-11-04
- epss
- 92.1%
- EPSS 92.1% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.
This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Patch / fix
cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- gladinet centrestack 16.10.10408.56683
Timeline
- First public exploit (Metasploit auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371)
- Published
- Added to CISA KEV
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 12 mo ago
- Patch by
- 2025-11-25 (11 mo ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Gladinet, CentreStack and Triofox
- CISA name
- Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
Ransomware
Groups reported to have exploited it in intrusions.
- Clop ransomware gang
reported by securityaffairs.com
Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction
92.14% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371 Gladinet CentreStack/Triofox Path Traversal metasploit auxiliary, normal rank, 2025-04-03
- Nuclei template Gladinet CentreStack & TrioFox - Local File Inclusion nuclei detection template
- huntress.com https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Gladinet CentreStack and TrioFox
Classification
- Weakness
-
- CWE-552 Files or Directories Accessible to External Parties
References
-
huntress.com
/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw
exploit, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11371
government-resource, us-government-resource
-
centrestack.com
/p/gce_latest_release.html
mitigation, release-notes
Sources
- CVE List CVE-2025-11371
- NVD CVE-2025-11371
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.