Security readout for executives and security teams
Plain-English summary
Gladinet CentreStack and TrioFox file-sharing platforms contain a flaw that lets anyone on the internet read sensitive files from the server without logging in. Attackers are already using this in real attacks. If your organization runs these products to share files with employees or customers, treat this as urgent and confirm you are on a fixed build.
Executive priority
Treat as urgent. The vulnerability is actively exploited, listed in CISA KEV, and requires no authentication, so any internet-exposed CentreStack or TrioFox deployment should be patched or isolated within standard emergency-change windows this week.
Technical view
CVE-2025-11371 is an unauthenticated Local File Inclusion (CWE-552) in the default install of Gladinet CentreStack and TrioFox at versions up to and including 16.7.10368.56560. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), reflecting network-reachable, no-auth disclosure of system files. Huntress reports in-the-wild exploitation, and CISA has added the issue to the KEV catalog.
Likely exposure
Internet-facing CentreStack or TrioFox tenants running default configurations on any version at or below 16.7.10368.56560. Because the flaw needs no authentication and targets the web tier, exposure tracks directly with whether the portal is reachable from untrusted networks, which is the typical deployment for these collaboration products.
Exploitation context
CISA KEV lists CVE-2025-11371 as actively exploited, and Huntress published observations of in-the-wild abuse. Public reporting frames the issue as disclosure of system files that can expose secrets useful for follow-on intrusion. No exploit details are reproduced here.
Researcher notes
CWE-552 with an unauthenticated network vector typically yields disclosure of configuration files, machine keys, or tokens that enable lateral movement or session forgery. Confidence on root cause is medium because public sources confirm LFI behavior but stop short of full technical detail; pair patching with credential and key rotation rather than relying on the upgrade alone.
Mitigation direction
- Upgrade CentreStack and TrioFox to a build newer than 16.7.10368.56560 per the vendor release page.
- Until patched, restrict portal exposure with WAF, IP allow-listing, or VPN-only access.
- Rotate any secrets, machine keys, or credentials that may have been readable from disk.
- Review vendor advisories and Huntress guidance for any configuration hardening steps.
- Monitor vendor channels for follow-on advisories tied to the same KEV entry.
Validation and detection
- Inventory all CentreStack and TrioFox instances and record exact build numbers.
- Confirm each instance is above version 16.7.10368.56560 after upgrade.
- Hunt web and IIS logs for unusual file-path parameters or unauthenticated read attempts to portal endpoints.
- Check for unexpected outbound connections or new accounts created on affected hosts.
- Validate WAF or perimeter rules block direct portal access from untrusted ranges.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-552: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-11371 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flawCVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11371CVE reference · government-resource
- https://www.centrestack.com/p/gce_latest_release.htmlCVE reference · mitigation
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.