https://pwn.watch/t/gladinet Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 15 Dec 2025 00:00:00 GMT https://pwn.watch/i/gladinet-centrestack-and-triofox-cve-2025-14611 https://pwn.watch/i/gladinet-centrestack-and-triofox-cve-2025-14611 Mon, 15 Dec 2025 00:00:00 GMT high <p>Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. Added to CISA KEV on 2025-12-15.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-12-15: CISA added CVE-2025-14611 to the KEV catalog (due 2026-01-05).</li></ul> <p><strong>CVEs:</strong> CVE-2025-14611</p> https://pwn.watch/i/gladinet-triofox-cve-2025-12480 https://pwn.watch/i/gladinet-triofox-cve-2025-12480 Wed, 12 Nov 2025 00:00:00 GMT critical <p>Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete. Added to CISA KEV on 2025-11-12.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-11-12: CISA added CVE-2025-12480 to the KEV catalog (due 2025-12-03).</li></ul> <p><strong>CVEs:</strong> CVE-2025-12480</p> https://pwn.watch/i/gladinet-centrestack-and-triofox-cve-2025-11371 https://pwn.watch/i/gladinet-centrestack-and-triofox-cve-2025-11371 Tue, 04 Nov 2025 00:00:00 GMT high <p>Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files. Added to CISA KEV on 2025-11-04.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-11-04: CISA added CVE-2025-11371 to the KEV catalog (due 2025-11-25).</li></ul> <p><strong>CVEs:</strong> CVE-2025-11371</p> https://pwn.watch/i/gladinet-centrestack-cve-2025-30406 https://pwn.watch/i/gladinet-centrestack-cve-2025-30406 Tue, 08 Apr 2025 00:00:00 GMT critical <p>Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution. Added to CISA KEV on 2025-04-08.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-04-08: CISA added CVE-2025-30406 to the KEV catalog (due 2025-04-29).</li></ul> <p><strong>CVEs:</strong> CVE-2025-30406</p>