KEV · Actively exploited
CVE-2025-11371
CVE-2025-11371 is actively exploited (CISA KEV catalog) : high severity (CVSS 7.5), 0 tracked apps concerned, none still exposed on their current version.
- Severity (CVSS)
- 7.5
- Exploitation
- Confirmed
- Tracked apps
- 0
- Still exposed
- 0
NVD scale
CISA KEV · EPSS predicts 92.1 %
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.
This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Attack vector : Network
No privileges required
No user interaction
Show raw CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
92.09%
predictive model; CISA confirms active exploitation
percentile 99.8%
CISA Known Exploited Vulnerability
- Added to KEV
- 2025-11-04
- Remediation deadline
- 2025-11-25
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Ransomware
- Unknown (not documented by CISA)