---
id: "CVE-2025-14611"
kind: "vulnerability"
aliases: ["CVE-2025-14611"]
title: "Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Gladinet CentreStack and Triofox", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "gladinet centrestack", "fixed": ["16.12.10420.56791"], "affected": "< 16.12.10420.56791", "ecosystem": "vendor"}, {"name": "gladinet triofox", "fixed": ["16.12.10420.56791"], "affected": "< 16.12.10420.56791", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["centrestack", "exploited", "gladinet", "other", "self-hosted", "triofox", "windows"]
not_affected_if: ["unknown"]
published_at: "2025-12-12T21:15:53+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14611", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14611", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation…

Gladinet CentreStack and Triofox ship hardcoded AES cryptographic keys, which weakens the crypto on public endpoints. An unauthenticated attacker can send a crafted request to read arbitrary local files on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Gladinet CentreStack and Triofox affected ? fixed ?
- vendor:gladinet centrestack affected < 16.12.10420.56791 fixed 16.12.10420.56791
- vendor:gladinet triofox affected < 16.12.10420.56791 fixed 16.12.10420.56791

## Fix

Apply the vendor mitigations per CISA guidance; the sources do not name a fixed version.
If no mitigation is available, discontinue use of the product.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-14611
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-14611

## From the sources

Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_