Latest Gladinet Triofox vulnerabilities #
As disclosed by multiple organizations, certain versions of Gladinet Triofox are affected by multiple vulnerabilities:
- An improper access control vulnerability allows a remote, unauthenticated adversary to access the initial configuration pages even after setup is complete. Successful exploitation involves setting the HTTP Host header value to localhost, which allows an adversary to circumvent authentication controls, access initial configuration pages, create a new administrator account to gain WebUI access, and subsequently achieve remote code execution (RCE) on the host using the antivirus executable feature. This vulnerability has been designated CVE-2025-12480 and has been rated critical with a CVSS score of 9.1.
- A local file inclusion (LFI) vulnerability exists in the /storage/t.dn endpoint. Successful exploitation allows a remote, unauthenticated adversary to read arbitrary system files, such as the application's Web.config file, via specially crafted HTTP GET requests using the s query parameter. This vulnerability has been designated CVE-2025-11371 and has been rated high with a CVSS score of 7.5.
There is evidence that these vulnerabilities are being actively exploited in the wild.
The following versions are affected
- Gladinet Triofox versions prior to 16.7.10368.56560 are affected by CVE-2025-12480, while versions prior to and including 16.7.10368.56560 are affected by CVE-2025-11371.
What is Gladinet Triofox? #
Gladinet Triofox is a self-hosted software solution that provides secure, VPN-less remote access to on-premise file servers, integrating with existing NTFS permissions and supporting authentication via Active Directory alongside integration with single sign-on (SSO) providers.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- Gladinet Triofox upgrade to version 16.10.10408.56683 or later
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially vulnerable assets:
_asset.protocol:http AND protocol:http AND favicon.ico.image.md5:="bf2c9797fd72c284d99d116e1e02ea18"
