CVE-2025-11371
📋 TL;DR
An unauthenticated Local File Inclusion vulnerability in Gladinet CentreStack and TrioFox allows attackers to read sensitive system files without credentials. This affects all versions up to and including 16.7.10368.56560. Active exploitation has been observed in the wild.
💻 Affected Systems
- Gladinet CentreStack
- Triofox
📦 What is this software?
Centrestack by Gladinet
Triofox by Gladinet
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive configuration files, credentials, or SSH keys leading to lateral movement and data exfiltration.
Likely Case
Unauthorized disclosure of sensitive system files, configuration data, and potentially credential harvesting.
If Mitigated
Limited impact with proper network segmentation and file system permissions restricting access to critical files.
🎯 Exploit Status
Exploitation observed in the wild. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 16.7.10368.56560
Vendor Advisory: https://www.centrestack.com/p/gce_latest_release.html
Restart Required: Yes
Instructions:
1. Download latest version from vendor site. 2. Backup configuration. 3. Install update. 4. Restart service. 5. Verify version.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to vulnerable endpoints using firewall rules or WAF.
Authentication Enforcement
allRequire authentication for all file access endpoints if supported.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy WAF with LFI protection rules and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Test if unauthenticated file inclusion is possible via HTTP requests to vulnerable endpoints.Check Version:
Check application version in admin interface or configuration filesVerify Fix Applied:
Verify version is above 16.7.10368.56560 and test that file inclusion attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unusual file path patterns in HTTP logs
- Multiple failed file inclusion attempts
- Access to sensitive system file paths
Network Indicators:
- HTTP requests with directory traversal patterns
- Requests for known sensitive files
SIEM Query:
source="web_logs" AND (uri="*../*" OR uri="*..\\*" OR uri="*/etc/passwd*" OR uri="*/windows/win.ini*")