Triofox - Missing Authorization (CVE-2025-12480)

CVE-2025-12480 is a critical improper access control vulnerability in Triofox versions prior to 16.7.10368.56560, which allows unauthorized users to access initial setup pages even after the setup process is complete. This flaw could enable attackers to reconfigure or compromise the system, potentially leading to unauthorized access to sensitive data and system settings.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-12480 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-12480 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-12480 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit this vulnerability by sending unauthenticated requests to the /management/admindatabase.aspx endpoint, granting access to sensitive database management functions without requiring credentials.