CVE-2025-14611
CRITICAL KEV NUCLEIGladinet CentreStack & Triofox <16.12.10420.56791 - Code Injection
Title source: llmExploitation Summary
CVE-2025-14611 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 15, 2025.
EIP tracks 3 public exploits from researchers including dyeat, pl4tyz, Huntress Team, including a Metasploit module auxiliary/gather/gladinet_storage_access_ticket_forge.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-14611, targeting Gladinet CentreStack. It includes steps for arbitrary file read, key extraction, and RCE via deserialization using ysoserial.net. The PoC demonstrates encryption key manipulation and payload generation for exploitation.
Description
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. This opens the door for future exploitation and can be leveraged with previous vulnerabilities to gain a full system compromise.
Exploits (3)
This repository contains a functional exploit for CVE-2025-14611, targeting Gladinet CentreStack. It includes steps for arbitrary file read, key extraction, and RCE via deserialization using ysoserial.net. The PoC demonstrates encryption key manipulation and payload generation for exploitation.
This repository contains a detailed analysis and proof-of-concept exploit for CVE-2025-14611, which involves hardcoded cryptographic keys in Gladinet CentreStack and Triofox products. The exploit demonstrates arbitrary file read through forged access tickets, leveraging static AES-256 keys embedded in the application binary.
This Metasploit module exploits CVE-2025-14611 by forging access tickets for Gladinet CentreStack/Triofox using hardcoded cryptographic keys. It allows arbitrary file reads, including Web.config extraction for potential RCE via machineKey.
Nuclei Templates (1)
title="CentreStack" || title="Triofox"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H