Search/CVE-2025-11371
● CVE — High

CVE-2025-11371

VendorgladinetProductcentrestack, triofoxDiscoveredOct 9, 2025UpdatedNov 5, 2025

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

View graph Watch Export
CVSS v3.1
7.5 HIGH
EPSS
92.1%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
7
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 10, 2026
▲ 0.04pp
92.1% → 92.1% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityNONE
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Connections
10 relationships
Timeline
disclosure → media coverage
Oct 9, 2025
Disclosure — published as a CVE record. · last revised by NVD Nov 5, 2025
Oct 10, 2025
thehackernews.com reports: From LFI to RCE: Active Exploitation Detected in Gladinet and TrioFox Vulnerability
Oct 10, 2025
acn.gov.it reports: Gladinet: rilevato sfruttamento in rete della CVE-2025-11371
Oct 10, 2025
helpnetsecurity.com reports: Attackers are exploiting Gladinet CentreStack, Triofox vulnerability with no patch (CVE-2025-11371)
Oct 10, 2025
bleepingcomputer.com reports: Hackers exploiting zero-day in Gladinet file sharing software
Oct 16, 2025
bleepingcomputer.com reports: Gladinet fixes actively exploited zero-day in file-sharing software
Nov 5, 2025
thehackernews.com reports: CISA Adds Gladinet and CWP Flaws to KEV Catalog Amid Active Exploitation Evidence
Nov 5, 2025
helpnetsecurity.com reports: Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703)
Public PoC (3)
github.com/rxerium/CVE-2025-11371github.com/lap1nou/CVE-2025-11371github.com/NetVanguard-cmd/CVE-2025-11371
Unverified third-party code — review before executing.