Historical catalog analysis: CISA added this entry on December 15, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-14611 describes a vulnerability involving hardcoded cryptographic keys (CWE-798) within the AES cryptoscheme implementation used by Gladinet CentreStack and Triofox. The use of static keys degrades the security posture of affected systems, potentially allowing an unauthenticated attacker to achieve arbitrary local file inclusion by sending specially crafted requests.
Exposure and applicability
This vulnerability applies to deployments of Gladinet CentreStack and Triofox. Exposure is specifically heightened for endpoints that are publicly accessible and utilize the affected AES implementation. Organizations utilizing these products as cloud services or on public-facing infrastructure should prioritize identifying whether their specific configuration relies on the vulnerable cryptographic implementation.
Remediation priorities
Based on our analysis, vulnerability management teams should prioritize the following actions to reduce exposure:
- Apply Vendor Mitigations: The primary corrective action is to implement mitigations as specified in vendor instructions. This is the most direct method to address the hardcoded key issue.
- Review Cloud Service Guidance: For organizations utilizing these products via cloud deployments, we recommend following BOD 22-01 guidance to ensure that service provider mitigations are active and verified.
- Evaluate Product Viability: In scenarios where vendor mitigations are unavailable or cannot be applied to the specific environment, the source suggests discontinuing use of the product as a risk reduction measure.
How to validate remediation
Verification must go beyond simple version checks, as a version number does not inherently prove that hardcoded keys have been replaced or that the AES implementation has been secured.
Defenders should verify remediation by confirming the successful application of vendor-provided patches and hardening guides. Validation evidence should include logs or configuration audits showing the transition to a secure cryptographic state. Because this vulnerability allows for local file inclusion, security teams may consider authorized testing—conducted in a non-production environment—to confirm that specially crafted requests no longer result in unauthorized file access.
Limits and open questions
It remains unknown whether this vulnerability has been leveraged in active ransomware campaigns. Additionally, the source does not specify which exact versions of CentreStack and Triofox are affected, requiring administrators to refer directly to vendor release histories for applicability. Residual risk persists if mitigations are applied but public endpoints remain exposed without additional compensating controls, such as strict network access control lists (ACLs) or web application firewalls (WAFs) capable of detecting the specific request patterns used for local file inclusion.
Source and editorial note
CVE-2025-14611: Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability · Source date: December 15, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: December 18, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 26, 2026 at 00:36 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗