{"id":"CVE-2025-12480","kind":"vulnerability","aliases":["CVE-2025-12480"],"related":[],"title":"gladinet triofox: Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to…","description":"Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Gladinet Triofox, a file sharing and remote access server, exposes its initial setup pages even after setup is finished. An attacker who can reach the server could reach those setup pages and potentially reconfigure the system.","severity":"critical","cvss":9.1,"epss":null,"exploited":true,"exploited_at":"2025-11-12T00:00:00+00:00","products":[{"name":"gladinet triofox","fixed":["16.7.10368.56560"],"affected":"< 16.7.10368.56560","ecosystem":"vendor"},{"name":"Gladinet Triofox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","gladinet-triofox","other","self-hosted","windows"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor mitigation from Gladinet, or discontinue use of Triofox if no mitigation is available (per CISA KEV required action).","status":"open","published_at":"2025-11-10T15:15:36+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:21+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T20:44:21Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation from Gladinet, or discontinue use of Triofox if no mitigation is available (per CISA KEV required action).","reach":"internet","summary":"Gladinet Triofox, a file sharing and remote access server, exposes its initial setup pages even after setup is finished. An attacker who can reach the server could reach those setup pages and potentially reconfigure the system.","category":"other","who_cares":["gladinet-triofox","self-hosted","windows"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reaches setup pages and may take over the server configuration","analyst_note":"Find the Gladinet vendor advisory and affected/fixed versions, and confirm which setup URLs are exposed and how to check whether setup is still reachable; sources only give the KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000431,"input_tokens":2519,"output_tokens":359,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':106C '-12480':21A,24A '-2025':20A,23A '16.7.10368.56560':7A '22':105C 'access':13A,18A,45B,79C,84C 'action':96C 'allow':17A,83C 'appli':97C 'applic':103C 'attack':58B 'bod':104C 'cisa':94C 'cloud':109C 'complet':93C 'contain':76C 'control':14A,80C 'could':64B 'cve':19A,22A 'discontinu':112C 'even':52B,89C 'exploit':29B 'expos':47B 'file':41B 'finish':56B 'flaw':15A 'follow':102C 'gladinet':1A,25A,27A,31B,38B,74C 'gladinet-triofox':30B 'guidanc':107C 'host':36B 'improp':12A,78C 'initi':49B,86C 'instruct':101C 'mitig':98C,118C 'page':51B,68B,88C 'per':99C 'potenti':70B 'prior':5A 'product':116C 'reach':61B,65B 'reconfigur':71B 'remot':44B 'requir':95C 'self':35B 'self-host':34B 'server':46B,63B 'servic':110C 'setup':50B,54B,67B,87C,91C 'share':42B 'system':73B 'triofox':2A,3A,26A,28A,32B,39B,75C 'unavail':120C 'use':113C 'vendor':100C 'version':4A 'vulner':9A,81C 'window':37B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-11-10T15:15:36+00:00","kev":{"dateAdded":"2025-11-12","dueDate":"2025-12-03","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"mandiant-cve@google.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-12480","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-12480","severity":null,"published_at":"2025-11-12T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-12480","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12480","severity":null,"published_at":"2025-11-10T15:15:36+00:00","modified_at":"2026-10-19T13:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}