Full Report
Huntress has observed in-the-wild exploitation of a Local File Inclusion vulnerability in Gladinet CentreStack and Triofox products.
Analysis Summary
# Vulnerability: Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion
## CVE Details
- **CVE ID:** CVE-2025-11371
- **CVSS Score:** Not explicitly listed in the text (Note: Related flaw CVE-2025-30406 was "Critical")
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Local File Inclusion)
## Affected Systems
- **Products:** Gladinet CentreStack and Triofox
- **Versions:** Versions prior to 16.10.10408.56683
- **Configurations:** Systems exposed to the public internet; particularly those previously thought to be secured against CVE-2025-30406.
## Vulnerability Description
CVE-2025-11371 is an unauthenticated Local File Inclusion (LFI) vulnerability. It allows a remote attacker to read arbitrary files from the server's filesystem. Specifically, threat actors are using this flaw to retrieve the application's `Web.config` file. By obtaining the hardcoded **machine key** from this file, attackers can then bypass previous patches and perform Remote Code Execution (RCE) via a ViewState deserialization attack (re-enabling the exploitation path of the older CVE-2025-30406).
## Exploitation
- **Status:** Exploited in the wild (Observed by Huntress SOC starting Sept 2025)
- **Complexity:** Low (Targeted via internet mapping tools like FOFA)
- **Attack Vector:** Network (Unauthenticated GET requests)
## Impact
- **Confidentiality:** High (Ability to read sensitive configuration files and system data)
- **Integrity:** High (Full system compromise via subsequent RCE)
- **Availability:** High (Potential for complete host takeover and service disruption)
## Remediation
### Patches
- **Gladinet CentreStack:** Update to **version 16.10.10408.56683** (released October 14, 2025) or later.
- **Triofox:** Organizations should check for the equivalent latest build number from the vendor.
### Workarounds
- Implement immediate IP-based access control lists (ACLs) to restrict access to the portal login pages.
- Ensure the application is not directly internet-facing if possible.
## Detection
- **Indicators of Compromise (IoC):**
- Referrer headers originating from `hxxps[://]en[.]fofa[.]info/`.
- Unusual `GET` requests to `/portal/loginpage.aspx` followed by attempts to access `Web.config`.
- Irregular base64 payloads executed as a child process of the web server (`w3wp.exe`).
- **Detection Methods:** Monitor web server logs for path traversal patterns or unauthorized access to sensitive `.config` files.
## References
- **Vendor Release Notes:** [hxxps[://]www[.]centrestack[.]com/p/gce_latest_release[.]html]
- **Huntress Blog:** [hxxps[://]www[.]huntress[.]com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw]
- **CVE Record:** [hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2025-11371]