CVE-2025-11371 KEV
7.5
HIGH · CVSS 3.1 · EPSS 92.1% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2025-11-25.
Description
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560
Scoring
| CVSS | 7.5 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 92.14% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-552 |
| On CISA KEV | yes — remediate by 2025-11-25 |
| Public exploit | none known |
| Published | 2025-10-09 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability |
|---|---|
| Added | 2025-11-04 |
| Due | 2025-11-25 |
| Vendor / product | Gladinet / CentreStack and Triofox |
| Ransomware use | none reported |
Affected (2)
| Vendor | Product |
|---|---|
| gladinet | centrestack |
| gladinet | triofox |
References
→ the Explorer · watch your stack · NVD