{"id":"CVE-2025-11371","published":"2025-10-09T17:15:58Z","modified":"2026-10-08T13:10:00Z","title":"Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability","vendor":"Gladinet","product":"CentreStack and Triofox","tier":"core","eol":null,"description":{"text":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. \n\nThis issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a Files or Directories Accessible to External Parties weakness in Gladinet CentreStack and Triofox, present in the default installation and configuration. An attacker who can reach the product over the network can exploit an unauthenticated local file inclusion issue, requiring no privileges and no user interaction, to read system files they should not have access to.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:51Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.92137,"percentile":0.99821,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-11-04","dueDate":"2025-11-25","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.centrestack.com/p/gce_latest_release.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-11371","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-10-09","exploitedFirstSeen":"2025-10-09","ransomware":true,"evidence":[{"url":"https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw","date":"2025-10-09"},{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2025-11371/","date":"2025-10-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-11-04"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-11371","date":"2025-11-05"},{"url":"https://www.recordedfuture.com/blog/october-2025-cve-landscape","date":"2025-11-06"},{"url":"https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability","date":"2025-12-12"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://blackpointcyber.com/wp-content/uploads/2026/04/2026-Annual-Threat-Report-Blackpoint-Cyber.pdf","date":"2026-04-07"},{"url":"https://www.antiy.net/p/inventory-of-active-ransomware-attack-groups-in-2025","date":"2026-04-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-18&host_type=src&vulnerability=cve-2025-11371","date":"2026-09-18"}],"evidenceTotal":19,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks","url":"https://otx.alienvault.com/pulse/6ae2834b1c69ab7ae8d4f81b","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-552","name":"Files or Directories Accessible to External Parties"}],"references":[{"url":"https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.centrestack.com/p/gce_latest_release.html","tags":["Release Notes"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11371","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploit of public-facing web application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"there is an unauthenticated Local File Inclusion Flaw","start":83,"end":136}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local file inclusion reads arbitrary system files","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows unintended disclosure of system files","start":142,"end":186}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-33408","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33408","exploited":true,"exploitedSince":"2025-11-04","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2025-10-10","earliestUrl":"https://github.com/rxerium/CVE-2025-11371","repos":[{"name":"rxerium/CVE-2025-11371","url":"https://github.com/rxerium/CVE-2025-11371","stars":6,"created":"2025-10-10"},{"name":"lap1nou/CVE-2025-11371","url":"https://github.com/lap1nou/CVE-2025-11371","stars":1,"created":"2025-10-11"},{"name":"NetVanguard-cmd/CVE-2025-11371","url":"https://github.com/NetVanguard-cmd/CVE-2025-11371","stars":1,"created":"2025-10-15"}]},"metasploit":[{"name":"Gladinet CentreStack/Triofox Path Traversal","module":"auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371","type":"auxiliary","disclosureDate":"2025-04-03","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb"}],"nuclei":[{"id":"CVE-2025-11371","name":"Gladinet CentreStack & TrioFox - Local File Inclusion","severity":"medium","path":"http/cves/2025/CVE-2025-11371.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11371.yaml"}],"first":{"date":"2025-04-03","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb"},"provenance":"source"},"exploitRefs":["https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2025-04-03","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-10-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb","provenance":"source"},{"date":"2025-10-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11371","provenance":"source"},{"date":"2025-10-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw","provenance":"source"},{"date":"2025-11-04","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-11-04","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33408","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":26},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 386 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9982"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}