# CVE-2025-14611: CentreStack And TrioFox - Information Disclosure

> Live exploitation tracking for CVE-2025-14611 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-14611

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.1
- **Public exploit available:** Yes
- **Affected products:** Gladinet CentreStack And TrioFox
- **Weaknesses:** CWE-798 (Use of Hard-coded Credentials)
- **Tags:** file_sharing, enterprise_software

## Description

Gladinet CentreStack And TrioFox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for publicly exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.

## CrowdSec analysis

[CVE-2025-14611](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-14611) is a high-severity vulnerability in Gladinet CentreStack And TrioFox caused by hardcoded AES cryptographic values used by publicly exposed endpoints. Unauthenticated attackers could exploit specially crafted requests to perform arbitrary local file inclusion and disclose sensitive information, potentially chaining the flaw with other vulnerabilities to achieve full system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 9th of September 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-14611 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target the `/storage/filesvr.dn` endpoint with crafted `t` parameters containing encrypted path traversal/file inclusion tokens. Successful exploitation  returns sensitive local configuration files, commonly identified by XML content such as `<configuration>` and `<system.web>`.

## Timeline

- 2025-12-12: CVE Published. CVE-2025-14611 is published to NVD.
- 2025-12-15: CISA KEV. CVE-2025-14611 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-01-05: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-09-09: Rule Released. CrowdSec releases a rule to detect CVE-2025-14611 exploitation attempts against the CrowdSec Network.

## References

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14611
- https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14611.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-14611) follows observed exploitation activity for CVE-2025-14611. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.