Critical Gladinet CentreStack & Triofox Flaw Under Active Attack
A severe unauthenticated Local File Inclusion (LFI) vulnerability, identified as CVE-2025-11371, is currently being actively exploited by malicious actors targeting Gladinet CentreStack and Triofox platforms. These platforms are widely utilized for secure file-sharing and remote access, offering essential benefits such as enhanced collaboration, seamless remote work capabilities, and centralized data management. The LFI flaw allows attackers to read arbitrary files on the server without requiring any authentication, posing a significant risk of sensitive data exposure and potential system compromise.
Despite the ongoing exploitation, Gladinet has not yet released an official patch for CVE-2025-11371, though one is reportedly in development. This situation leaves organizations relying on CentreStack and Triofox highly vulnerable to sophisticated cyberattacks. The immediate and critical risk stems from the unauthenticated nature of the vulnerability, meaning attackers can initiate exploitation without needing valid user credentials, making these systems prime targets for data breaches and unauthorized access. The severity is underscored by confirmed reports of in-the-wild exploitation affecting at least three customers, indicating a tangible and immediate threat.
In the absence of a permanent patch, users are strongly urged to implement a crucial mitigation step: disabling a specific handler within their installation’s Web.config file. This temporary measure is vital for protecting systems against ongoing attacks until a definitive security update becomes available. The incident highlights the persistent danger of zero-day vulnerabilities and the critical importance of proactive security measures, continuous monitoring, and prompt application of vendor-provided mitigations to safeguard critical infrastructure and sensitive data against evolving cyber threats.
