CVE-2025-14611
Hard Coded Cryptographic in Gladinet CentreStack and Triofox. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 15 December 2025.
- Product
- Gladinet CentreStack and Triofox
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.
More from Gladinet this year.
- CVE-2025-12480 Improper Access Control, added
- CVE-2025-11371 Files or Directories Accessible to External Parties, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 3 November 2026.