CVE-2025-12480

Katalog CVE

CVSS 9.1 · Critical KEV · sudah dieksploitasi EPSS 95,7%

Kerentanan Improper Access Control pada gladinet triofox. Skor CVSS 3.1 9.1 (Critical) menurut google.com. Masuk katalog KEV CISA pada 12 November 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

Rincian

Terbit di NVD

10 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber google.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

95,7% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Gladinet Triofox Improper Access Control Vulnerability

Masuk KEV

12 November 2025

Tenggat CISA

3 Desember 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-12480 pemerintah AS
• https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480 exploit · advisory pihak ketiga
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0008.md advisory pihak ketiga
• https://access.triofox.com/releases_history/ release notes
• https://www.triofox.com/ product