CVE-2025-11371

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 92,1%

Kerentanan Files or Directories Accessible to External Parties pada gladinet centrestack, gladinet triofox. Skor CVSS 3.1 7.5 (High) menurut CISA ADP. Masuk katalog KEV CISA pada 4 November 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild.  This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560

Rincian

Terbit di NVD

9 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

92,1% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Masuk KEV

4 November 2025

Tenggat CISA

25 November 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11371 pemerintah AS
• https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw exploit · advisory pihak ketiga
• https://www.centrestack.com/p/gce_latest_release.html release notes