HIGH 7.5 KEV Published on 2025-10-09

CVE-2025-11371

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.

This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

CVSS v3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA Known Exploited Vulnerability

Added to KEV: 2025-11-04
Remediation deadline: 2025-11-25
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware: No

Affected tracked apps

Triofox

com.gladinet.triofox

1 open 1 exploited

Vulnerable CPE configurations

Vendor	Product	Platform	Versions	CPE 2.3 URI
gladinet	triofox	iOS	≤16.7.10368.56560	cpe:2.3:a:gladinet:triofox::::::::

View on NVD ↗ CISA KEV catalog ↗