rxerium/CVE-2025-11371

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects CVE-2025-11371 by fetching the CentreStack login page, extracting the build version via regex, and comparing it against the vulnerable version range.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Nuclei detection template for CVE-2025-11371 and a README. The template performs a benign GET request to a login page, extracts a version string, and compares it to a known vulnerable version. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesYAML
Target softwareGladinet CentreStackGladinet TrioFox
Attack typesLocal File Inclusion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that only detects the presence of a vulnerable version by checking the login page and comparing the build number. It does not include any code to read or exfiltrate local files, which would be required for an exploit. The README explicitly describes it as a detection script.

CVE-2025-11371.yaml:1-43README.md:7

Requirements

  • Target must be running Gladinet CentreStack or TrioFox with a reachable login page.CVE-2025-11371.yaml:18

Observed behavior

  • Sends an HTTP GET request to /portal/loginpage.aspx.CVE-2025-11371.yaml:16-18
  • Extracts the build version from the response body using the regex '\(Build\s+([0-9.]+)\)'.CVE-2025-11371.yaml:22-28
  • Checks if the response body contains 'CentreStack - Login'.CVE-2025-11371.yaml:32-35
  • Compares the extracted version to determine if it is <= 16.7.10368.56560.CVE-2025-11371.yaml:37-39
  • Reports the target as vulnerable if all matchers succeed.CVE-2025-11371.yaml:30-43
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
{{BaseURL}}/portal/loginpage.aspxTarget path used by the Nuclei template to detect the vulnerable application.CVE-2025-11371.yaml:18
Regex
\\(Build\\s+([0-9.]+)\\)Regex used to extract the build version from the response body for vulnerability comparison.CVE-2025-11371.yaml:28
Version Comparison
compare_versions(version, '<= 16.7.10368.56560')DSL matcher that checks if the extracted version is vulnerable.CVE-2025-11371.yaml:39
Review boundaries

What the analysis did not establish

  • One file (likely an image) was omitted from the evidence packet, but the README and YAML template are complete and sufficient for classification.
  • One text file (likely a license) was omitted from content review; its metadata shows 1073 bytes and no indication of executable behavior.
  • The review covers only the supplied text evidence and does not inspect the referenced external image or links.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1