Gladinet CentreStack / Triofox Hardcoded AES Key Enables Unauthenticated LFI and RCE Chain

Executive Summary

A critical insecure cryptography vulnerability in Gladinet CentreStack and Triofox exposes all versions prior to 16.12.10420.56791 to unauthenticated attack. The root cause is a hardcoded AES key embedded in the application source — an attacker who knows this static key can craft requests that exploit arbitrary local file inclusion (LFI), enabling access to sensitive configuration files including web.config.

In the wild, threat actors have been observed chaining CVE-2025-14611 with two related flaws — CVE-2025-30406 (hardcoded machineKey → ViewState deserialization) and CVE-2025-11371 — to achieve full unauthenticated remote code execution (RCE) in a single orchestrated attack workflow.

CISA added CVE-2025-14611 to the Known Exploited Vulnerabilities (KEV) catalog on December 15, 2025, with a remediation deadline of January 5, 2026.

Vulnerability Overview

Root Cause

Gladinet CentreStack and Triofox use AES encryption to protect certain application data and authentication tokens. However, the encryption key is statically hardcoded in the source code rather than being generated at runtime per-installation. Any attacker who extracts or knows this hardcoded value — which has been circulating in threat actor communities following reverse engineering — can:

1. Craft authentication bypass requests using the known key
2. Manipulate application parameters to trigger local file inclusion
3. Read arbitrary files from the web server, including the web.config configuration file containing sensitive secrets

Exploit Chain with CVE-2025-30406

When chained with CVE-2025-30406 (a separate hardcoded machineKey vulnerability), attackers progress from LFI to RCE:

CVE-2025-14611: Hardcoded AES key → Unauthenticated LFI
  ↓ Read web.config (contains machineKey value)
CVE-2025-30406: Known machineKey → Forge malicious ViewState payload
  ↓ Deserialize ViewState on server
CVE-2025-11371: Deserialization gadget → Arbitrary OS command execution
  ↓ Full unauthenticated RCE achieved

Threat intelligence from Huntress and Horizon3.ai indicates that observed attackers demonstrate pre-built exploit workflows with deep familiarity across all three vulnerability classes, suggesting organized and practiced threat actor groups.

Affected Products and Versions

CentreStack and Triofox are enterprise cloud file access and sharing platforms commonly deployed for remote access to on-premises file servers. Internet-exposed instances are particularly at risk.

Exploitation Timeline

FINRA issued a cybersecurity alert in January 2026 warning financial sector organizations specifically about active exploitation of Gladinet vulnerabilities.

Why This Is Especially Dangerous

Internet-Exposed by Design

CentreStack and Triofox are remote access products — they are intentionally exposed to the internet to allow remote file access. This dramatically expands the attack surface, as virtually all deployments are reachable from the public internet.

No Authentication Required

The exploit requires zero authentication. Any internet-connected machine can attempt exploitation without credentials, making mass scanning and exploitation trivial.

CISA KEV Means Active Exploitation Is Confirmed

CISA's KEV catalog is a list of vulnerabilities with confirmed evidence of active exploitation. Addition to the KEV is not speculative — it means threat actors are actively using this vulnerability against real targets right now.

Immediate Remediation

1. Patch Immediately

Upgrade to Gladinet CentreStack / Triofox version 16.12.10420.56791 or later. This is the only complete remediation.

2. Interim Mitigations (If Immediate Patching Is Not Possible)

• Remove public internet exposure: Place the portal behind a VPN or zero-trust access layer
• Restrict access by IP: Allow only known corporate IP ranges to reach the CentreStack/Triofox portal
• Rotate credentials: Assume the web.config may have already been read — rotate all secrets, API keys, and database passwords stored therein
• Block common exploit paths: Work with your WAF vendor to block known request patterns targeting this vulnerability

3. Post-Patch Actions

• Audit access logs from the past 90+ days for anomalous activity
• Search for evidence of LFI attempts (unusual file path parameters in logs)
• Verify integrity of the web application (check for webshells or unauthorized file writes)
• Rotate all credentials that may have been stored in web.config

Detection

Log Indicators to Hunt

Network Indicators

• Outbound connections to unfamiliar IPs from CentreStack/Triofox server processes
• Spike in POST request volume to authentication endpoints
• Requests with anomalous Base64-encoded parameters targeting file paths

Key Takeaways

1. CVSS 9.8 — No authentication required for initial exploitation; full RCE possible via chaining
2. CISA KEV listed — Active exploitation in the wild is confirmed
3. Patch to 16.12.10420.56791 immediately — No interim patch is safe; upgrade is mandatory
4. Remove from internet exposure until patched — these are remote-access products exposed by design
5. Rotate all web.config secrets — Assume configuration file may have been exfiltrated
6. Audit logs back 90+ days — Exploitation may have begun well before discovery

References

• Huntress — Active Exploitation of Gladinet CentreStack/Triofox
• Horizon3.ai — CVE-2025-14611 Attack Research
• FINRA Cybersecurity Alert — Gladinet Vulnerabilities (Jan 2026)
• The Hacker News — Hard-Coded Gladinet Keys Let Attackers
• CISA Known Exploited Vulnerabilities Catalog
• SentinelOne — CVE-2025-14611 Vulnerability Database