CentreStack And TrioFox - Information Disclosure (CVE-2025-14611)
Description
Gladinet CentreStack And TrioFox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for publicly exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
psychologyCrowdSec Analysis
CVE-2025-14611 is a high-severity vulnerability in Gladinet CentreStack And TrioFox caused by hardcoded AES cryptographic values used by publicly exposed endpoints. Unauthenticated attackers could exploit specially crafted requests to perform arbitrary local file inclusion and disclose sensitive information, potentially chaining the flaw with other vulnerabilities to achieve full system compromise.
CrowdSec has been tracking this vulnerability and its exploits since 9th of September 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-14611 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target the /storage/filesvr.dn endpoint with crafted t parameters containing encrypted path traversal/file inclusion tokens. Successful exploitation returns sensitive local configuration files, commonly identified by XML content such as <configuration> and <system.web>.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-12-12 |
| CISA KEV | 2025-12-15 |
| CISA Remediation Deadline | 2026-01-05 |
| Rule Released | 2026-09-09 |