{"id":"CVE-2025-14611","kind":"vulnerability","aliases":["CVE-2025-14611"],"related":[],"title":"Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation…","description":"Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Gladinet CentreStack and Triofox ship hardcoded AES cryptographic keys, which weakens the crypto on public endpoints. An unauthenticated attacker can send a crafted request to read arbitrary local files on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-12-15T00:00:00+00:00","products":[{"name":"Gladinet CentreStack and Triofox","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"gladinet centrestack","fixed":["16.12.10420.56791"],"affected":"< 16.12.10420.56791","ecosystem":"vendor"},{"name":"gladinet triofox","fixed":["16.12.10420.56791"],"affected":"< 16.12.10420.56791","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["centrestack","exploited","gladinet","other","self-hosted","triofox","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigations per CISA guidance; the sources do not name a fixed version.\nIf no mitigation is available, discontinue use of the product.","status":"open","published_at":"2025-12-12T21:15:53+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:44+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T20:42:44Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per CISA guidance; the sources do not name a fixed version.\nIf no mitigation is available, discontinue use of the product.","reach":"internet","summary":"Gladinet CentreStack and Triofox ship hardcoded AES cryptographic keys, which weakens the crypto on public endpoints. An unauthenticated attacker can send a crafted request to read arbitrary local files on the server.","category":"other","who_cares":["gladinet","centrestack","triofox","self-hosted","windows"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker reads arbitrary files from the server, including secrets and configuration.","analyst_note":"Find the vendor advisory and the fixed CentreStack and Triofox versions and the endpoints affected; check the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000458,"input_tokens":2610,"output_tokens":394,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':128C '-14611':17A,20A '-2025':16A,19A '16.12.10420.56791':8A '22':127C 'action':118C 'ae':44B,85C 'and':23A 'appli':119C 'applic':125C 'arbitrari':64B,104C 'attack':56B 'authent':115C 'bod':126C 'centrestack':2A,22A,26A,29B,39B,71C 'cisa':116C 'cloud':131C 'contain':74C 'craft':60B,112C 'crypto':50B 'cryptograph':45B,77C 'cryptoschem':86C 'cve':15A,18A 'degrad':89C 'discontinu':134C 'endpoint':53B,94C 'exploit':30B 'expos':93C 'file':66B,106C 'follow':124C 'gladinet':1A,21A,25A,27A,31B,38B,70C 'guidanc':129C 'hardcod':10A,43B,76C 'host':35B 'implement':14A,82C 'inclus':107C 'instruct':123C 'key':46B,78C 'local':65B,105C 'make':97C 'may':96C,102C 'mitig':120C,140C 'offer':103C 'per':121C 'prior':5A 'product':138C 'provid':109C 'public':52B,92C 'read':63B 'request':61B,113C 'requir':117C 'secur':90C 'self':34B 'self-host':33B 'send':58B 'server':69B 'servic':132C 'ship':42B 'special':111C 'triofox':4A,24A,28A,36B,41B,73C 'unauthent':55B 'unavail':142C 'use':9A,98C,135C 'valu':11A 'vendor':122C 'version':7A 'vulner':79C,88C 'weaken':48B 'window':37B 'without':114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-12-12T21:15:53+00:00","kev":{"dateAdded":"2025-12-15","dueDate":"2026-01-05","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5dacb0b8-2277-4717-899c-254586fe4912","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-14611","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14611","severity":null,"published_at":"2025-12-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-14611","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14611","severity":null,"published_at":"2025-12-12T21:15:53+00:00","modified_at":"2026-10-07T20:10:01+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}