Security readout for executives and security teams
Plain-English summary
CentreStack and TrioFox versions before 16.12.10420.56791 used hardcoded AES cryptographic values. For internet-facing systems, this can weaken protection and may allow unauthenticated arbitrary local file inclusion through crafted requests. Huntress reports active exploitation, making exposed deployments a priority even though the supplied KEV flag is false.
Executive priority
Treat as urgent for any exposed CentreStack or TrioFox deployment. The issue affects cryptographic trust and may enable unauthenticated file access, with reported active exploitation. Upgrade and exposure reduction should be tracked as a near-term remediation item.
Technical view
CVE-2025-14611 is a CWE-798 hardcoded-key flaw in Gladinet CentreStack and TrioFox before 16.12.10420.56791. The CVE describes degraded security for exposed endpoints using the AES scheme and possible unauthenticated arbitrary local file inclusion. It can be chained with prior vulnerabilities toward full system compromise. CVSS v4.0 score is 7.1 high with network, no-auth attack characteristics.
Likely exposure
Highest concern is internet-exposed CentreStack or TrioFox instances running versions before 16.12.10420.56791. Systems not externally reachable may still be at risk if attackers have network access. The provided data does not list exact endpoint names, deployment modes, or configuration prerequisites.
Exploitation context
Huntress labels this issue as actively exploited. The source bundle’s KEV field is false, so treat exploitation as vendor-researcher reported rather than confirmed through the provided KEV flag. The vulnerability has high impact when chained with earlier Gladinet issues, but exploitation details are intentionally not included here.
Researcher notes
Evidence is strongest for versions before 16.12.10420.56791 and CWE-798 hardcoded AES values. The CVE references possible arbitrary local file inclusion and chaining potential, but the provided bundle does not include endpoint specifics or safe detection logic. Use vendor and Huntress material for IOCs and validation details.
Mitigation direction
- Identify all CentreStack and TrioFox deployments and owners.
- Upgrade affected systems to 16.12.10420.56791 or later.
- Restrict external access to management or file-sharing interfaces where feasible.
- Review Gladinet and Huntress guidance for current indicators and hardening steps.
- Prioritize systems exposed to the internet or handling sensitive files.
Validation and detection
- Inventory product names and installed versions across servers.
- Confirm no instance runs below 16.12.10420.56791.
- Check whether instances are reachable from the internet.
- Review web and application logs for suspicious unauthenticated file access patterns.
- Validate compensating controls limit access until upgrades are complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-798: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-14611 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (4.0)
- Known Exploited
- Yes
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
7.1HighVector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A
Source materials
- CVE List V5 sourceCVE List V5
- https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerabilityCVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14611CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Hard-coded Credentials
Use of Hard-coded Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.