Gladinet CentreStack and Triofox: CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. Added to CISA KEV on 2025-12-15.

Why this severity: CVSS 7.1 (CNA, v4.0); actively exploited (CISA KEV)

Started

Dec 15, 2025

Closed

Dec 15, 2025

CVE

CVE-2025-14611

• #Gladinet
• CISA KEV

Notes & caveats

Derived from CISA KEV JSON feed catalogVersion 2026.10.21. CVSS from the CVE record (cvelistV5). Exact affected/fixed version strings are not always in the KEV record; verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier; many entries are older CVEs newly confirmed as exploited in 2025).