Gladinet Triofox Improper Access Control Vulnerability

Gladinet Triofox

Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete. Added to CISA KEV on 2025-11-12 (federal deadline 2025-12-03).

First seen: 12 Nov 2025
Last update: 12 Nov 2025, 12:00 UTC
Identifiers: CVE-2025-12480
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Gladinet Triofox Improper Access Control Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Gladinet Triofox
Ids: CVE-2025-12480

Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete. Added to CISA KEV on 2025-11-12 (federal deadline 2025-12-03).

## Steps
1. Search the repo, its CI and infra config for Gladinet Triofox. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-12480") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://access.triofox.com/releases_history https://nvd.nist.gov/vuln/detail/CVE-2025-12480
https://pwned.coffee/i/gladinet-triofox-improper-access-control-vulnerability-cve-2025-12480

Sources

Totalone hot coffee