Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability

Gladinet CentreStack and Triofox

Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. Added to CISA KEV on 2025-12-15 (federal deadline 2026-01-05).

First seen: 15 Dec 2025
Last update: 15 Dec 2025, 12:00 UTC
Identifiers: CVE-2025-14611
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Gladinet CentreStack and Triofox
Ids: CVE-2025-14611

Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication. Added to CISA KEV on 2025-12-15 (federal deadline 2026-01-05).

## Steps
1. Search the repo, its CI and infra config for Gladinet CentreStack and Triofox. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-14611") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://access.triofox.com/releases_history/ https://nvd.nist.gov/vuln/detail/CVE-2025-14611 https://support.centrestack.com/hc/en-us/articles/360007159054-Hardening-the-CentreStack-Cluster#h_01JQRV57T37HJFQZKBZH9NBXQP https://www.centrestack.com/p/gce_latest_release.html
https://pwned.coffee/i/gladinet-centrestack-and-triofox-hard-coded-cryptographi-cve-2025-14611

Sources

Totalone hot coffee