CVE-2025-12480

Gladinet Triofox Improper Access Control Vulnerability

Exploited in attacks Critical 9.1 Attack chance: 96%

What it is

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

CISA: Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: December 3, 2025

Added to the CISA list: November 12, 2025
Published: November 10, 2025
Severity: Critical 9.1 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 96% in the top 0.1% of all known vulnerabilities
Weakness: CWE-284
More details: NVD · CVE.org · CISA

All references (4)

More exploited flaws from Gladinet

Added	Vulnerability	Product	Severity	Attack chance
Dec 15, 2025	Hard Coded CryptographicCVE-2025-14611	CentreStack and Triofox	High 7.1	53%
Nov 4, 2025	Files or Directories Accessible to External PartiesCVE-2025-11371	CentreStack and Triofox	High 7.5	92%
Apr 8, 2025	and Triofox Use of Hard-coded Cryptographic KeyCVE-2025-30406	CentreStack	Critical 9.0	94%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.