CVE-2025-11371: 
Gladinet CentreStack vulnerability analysis and mitigation

CVE-2025-11371 is an unauthenticated Local File Inclusion (LFI) vulnerability in Gladinet CentreStack and TrioFox file-sharing software that allows remote attackers to read arbitrary system files without authentication. It affects all versions of Gladinet CentreStack prior to 16.10.10408.56683 and all versions of TrioFox up to and including 16.7.10368.56560. The vulnerability was discovered and disclosed by Huntress on October 9, 2025, with active in-the-wild exploitation observed prior to disclosure. It carries a CVSS v3.1 base score of 7.5 (High) (Huntress, CISA KEV).

The root cause is improper path validation in the GladinetStorage.TempDownload class within GSUploadDownloadProxy.dll, classified as CWE-552 (Files or Directories Accessible to External Parties) and CWE-22 (Path Traversal). The vulnerable endpoint /storage/t.dn is designed to serve files from a temporary directory for authenticated users but lacks authentication checks and does not sanitize the s parameter, allowing directory traversal sequences (..\) to escape the intended C:\Windows\Temp\glad_temp root. Because the application runs as NT AUTHORITY\SYSTEM, an attacker can traverse to any file on the system, including the Web.config file containing the ASP.NET machine key. Retrieval of this machine key enables a chained ViewState deserialization attack (related to CVE-2025-30406) leading to remote code execution (Huntress, Horizon3).

Successful exploitation allows unauthenticated remote attackers to read any file accessible to the SYSTEM account, including sensitive configuration files, credentials, and cryptographic keys. The most critical consequence is the chained attack path: by exfiltrating the ASP.NET machine key from Web.config, attackers can achieve full remote code execution via ViewState deserialization, leading to complete server compromise. Post-exploitation activity observed in the wild included system reconnaissance, deployment of remote access tools via the Triofox antivirus configuration feature, and large-scale data exfiltration by the Clop ransomware group targeting multiple organizations (Huntress, Security Affairs).

1. Reconnaissance: Identify internet-facing Gladinet CentreStack or TrioFox instances using search engines such as FOFA, Shodan, or Censys. Attackers have been observed using FOFA referrers in web server logs prior to exploitation.
2. Probe the vulnerable endpoint: Send an unauthenticated GET request to the /storage/t.dn endpoint with a path traversal payload in the s parameter, e.g.:

   GET /storage/t.dn?s=..\..\..\ Program+Files+(x86)\Gladinet+Cloud+Enterprise\root\Web.config&sid=1

3. Exfiltrate Web.config: The server responds with the contents of Web.config, which contains the ASP.NET machineKey (validationKey and decryptionKey values).
4. Forge a malicious ViewState payload: Using the extracted machine key, craft a malicious serialized ViewState payload (e.g., using ysoserial.net) that executes arbitrary commands when deserialized by the server.
5. Achieve Remote Code Execution: Submit the forged ViewState payload via a POST request to the application. The server deserializes the payload and executes the embedded command as NT AUTHORITY\SYSTEM.
6. Post-exploitation: Use the LFI endpoint to exfiltrate command output by redirecting results to a known file path (e.g., C:\programdata\CentreStac_log.txt) and then retrieving it via the same traversal technique. Deploy remote access tools or ransomware payloads for persistence and lateral movement (Huntress).

• Network: Unusual GET requests to /storage/t.dn with path traversal sequences (e.g., ..\..\..\) in the s parameter; HTTP referrers from FOFA (en.fofa.info) or similar internet scanning services in web server logs; outbound connections from the web server process to unknown external IPs.
• Logs: Web server access logs showing GET /storage/t.dn?s=..\..\..\Program+Files+(x86)\Gladinet+Cloud+Enterprise\root\Web.config&sid=1 returning HTTP 200 with ~1497 bytes; Windows Event ID 1316 in application logs indicating ViewState deserialization activity with base64-encoded payloads; child processes of the web server (e.g., cmd.exe, powershell.exe) executing commands like ipconfig /all.
• File System: Unexpected text files in C:\programdata\ (e.g., CentreStac_log.txt) containing command output; new or modified files in the Gladinet installation directory; web shells or remote access tool binaries dropped on the server.
• Process: Unusual child processes spawned by the IIS worker process (w3wp.exe) or Gladinet service processes; execution of reconnaissance commands (ipconfig, whoami, net user) as NT AUTHORITY\SYSTEM (Huntress).

Gladinet released a patch for CentreStack in version 16.10.10408.56683 on October 14, 2025; organizations should upgrade immediately (CISA KEV). For TrioFox, versions after 16.7.10368.56560 contain the fix. As a temporary workaround prior to patching, Huntress recommends disabling the temp handler in the Web.config file for UploadDownloadProxy located at C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config by removing the line referencing the t.dn handler — note this will impact some platform functionality. Additionally, organizations should implement network-level controls to restrict external access to Gladinet instances and monitor web server logs for path traversal patterns in the /storage/t.dn endpoint (Huntress).

Huntress, the discovering organization, published a detailed technical blog with proof-of-concept code and IOCs on October 9, 2025, and updated it on October 15 after the patch was released (Huntress). Mandiant (Google) warned of active exploitation by the threat actor tracked as UNC6485, specifically abusing the Triofox antivirus configuration feature to deploy remote access tools (The Hacker News). FINRA issued a cybersecurity alert to financial sector firms in January 2026 regarding ongoing exploitation of Gladinet vulnerabilities (FINRA). The vulnerability received broad coverage from BleepingComputer, The Register, SecurityWeek, and Infosecurity Magazine, with significant community discussion on Reddit and Bluesky highlighting the severity of the zero-day exploitation window and the Clop ransomware group's involvement.