CVE-2025-14611: Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.
Other sources
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gladinet CentreStack and TrioFoxto a version that resolves this vulnerability.Fixed in 16.12.10420.56791 - Compensating control
If mitigations are unavailable, discontinue use of Gladinet CentreStack and TrioFox.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14611?
CVE-2025-14611 has a high severity due to its exploitation potential through the use of hardcoded values in the AES cryptoscheme.
How do I fix CVE-2025-14611?
To fix CVE-2025-14611, you should upgrade Gladinet CentreStack and Triofox to version 16.12.10420.56791 or later.
What vulnerabilities does CVE-2025-14611 introduce?
CVE-2025-14611 introduces security risks for public exposed endpoints and could allow for arbitrary local file inclusion.
Which software versions are affected by CVE-2025-14611?
CVE-2025-14611 affects Gladinet CentreStack and Triofox versions prior to 16.12.10420.56791.
Who is the vendor responsible for CVE-2025-14611?
The vendor responsible for CVE-2025-14611 is Gladinet.