CVE-2025-11371:
Unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and TrioFox allows unintended disclosure of system files.
Score
A numerical rating that indicates how dangerous this vulnerability is.
7.5High- Published Date:Oct 9, 2025
- CISA KEV Date:Nov 4, 2025
- Industries Affected:20
26 DaysThreat Predictions
- EPSS Score:70.4
- EPSS Percentile:99%
Exploitability
- Score:3.9
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:NONE
- User Interaction:NONE
- Scope:UNCHANGED
Impact
- Score:3.6
- Confidentiality Impact:HIGH
- Integrity Impact:NONE
- Availability Impact:NONE
Description Preview
Unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and TrioFox allows unintended disclosure of system files.
Overview
The vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox is a Local File Inclusion flaw that can be exploited without authentication. This allows attackers to access and potentially disclose sensitive system files, compromising the confidentiality of the affected systems. The CVSS v3.1 score for this vulnerability is 6.1, indicating a medium severity level. The attack vector is local, requiring low attack complexity and privileges, and no user interaction. While the integrity impact is none, the confidentiality impact is high, and there is a low impact on availability. The vulnerability is associated with CWE-220, which relates to storage of sensitive data in a file with improper access control.
Remediation
- To address this vulnerability, organizations using Gladinet CentreStack or TrioFox should take the following steps:
- 1. Upgrade immediately to a version newer than 16.7.10368.56560.
- 2. If immediate upgrading is not possible, implement strict access controls and monitoring for any suspicious file access attempts.
- 3. Conduct a thorough security audit of the system to identify any potential compromises that may have occurred due to this vulnerability.
- 4. Review and enhance the overall security posture of the deployment, including network segmentation and least privilege principles.
- 5. Stay informed about any further security advisories from Gladinet regarding this issue.
References
Armis Early Warning
Armis Early Warning provides proactive threat intelligence and early detection capabilities.Click here to learn more.
- Armis Alert Date:Oct 10, 2025
- CISA KEV Date:Nov 4, 2025
- Days Early:26 Days
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
