Hardcoded Cryptographic Keys in Gladinet CentreStack & Triofox Enable Arbitrary Local File Inclusion (CVE‑2025‑14611)
What It Is – Gladinet CentreStack and Triofox embed a hard‑coded AES key in their codebase. The flaw allows an attacker to craft a request that triggers an arbitrary local‑file‑inclusion (LFI) path without authentication, effectively bypassing confidentiality controls.
Exploitability – Public‑facing endpoints that expose the vulnerable component can be abused directly; no public exploit code has been released, but the vulnerability is trivial to weaponize once discovered. CVSS v3.1 score is reported as 8.8 (High).
Affected Products – Gladinet CentreStack (file‑sync‑and‑share platform) and Triofox (enterprise file‑sharing solution).
Why It Matters for Trust & Control Assurance
- Cryptographic Key Management – Hard‑coded keys violate the control objective of “manage cryptographic keys throughout their lifecycle,” a requirement across SOC 2, ISO 27001, NIST CSF, and others.
- Secure Configuration – The LFI vector demonstrates a gap in secure configuration and code‑review processes, exposing the organization to unauthorized data access.
- Audit Evidence – Demonstrating that keys are generated, stored, and rotated under documented procedures provides defensible evidence for auditors and enterprise buyers demanding a trusted posture.
Recommended Actions
- Apply Gladinet’s vendor‑issued patch immediately.
- Rotate all AES keys used by CentreStack/Triofox and enforce a key‑generation policy tied to a hardware security module (HSM) or cloud KMS.
- Conduct a code‑review focused on hard‑coded secrets and update secure‑development guidelines.
- Map the cryptographic‑control gap to your framework of record and capture remediation evidence for audit readiness.
Source: CISA KEV – CVE‑2025‑14611