KEV · Actively exploited
CVE-2025-14611
CVE-2025-14611 is actively exploited (CISA KEV catalog) : critical severity (CVSS 9.8), 0 tracked apps concerned, none still exposed on their current version.
- Severity (CVSS)
- 9.8
- Exploitation
- Confirmed
- Tracked apps
- 0
- Still exposed
- 0
NVD scale
CISA KEV · EPSS predicts 53.3 %
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
Attack vector : Network
No privileges required
No user interaction
Show raw CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
53.30%
predictive model; CISA confirms active exploitation
percentile 98.9%
CISA Known Exploited Vulnerability
- Added to KEV
- 2025-12-15
- Remediation deadline
- 2026-01-05
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Ransomware
- Unknown (not documented by CISA)