Critical Triofox Zero-Day (CVE-2025-12480) Under Active Exploit: Host Header Bypass Allows Unauthenticated Admin Takeover

According to Mandiant Threat Defense, part of Google Cloud Security Operations, a critical unauthenticated access flaw in Gladinet’s Triofox file-sharing platform has been actively exploited in the wild by a threat actor tracked as UNC6485, now patched as CVE-2025-12480. The exploitation was first detected on 24 August 2025, when GTIG observed UNC6485 leveraging the Triofox flaw in combination with abuse of the built-in antivirus feature.

The vulnerability allowed bypassing authentication, creating administrative accounts, and achieving SYSTEM-level code execution through a chained attack path, with attackers targeting Triofox version 16.4.10317.56372 until mitigated in version 16.7.10368.56560.

Investigations also showed anomalous activity including remote access utility deployment, RDP tunneling, and suspicious file activity, after which the attackers created an AdminDatabase.aspx admin page access and a new Cluster Admin account to perform post-exploitation actions.

The root cause was insecure access checks in the Triofox web interface, where spoofing the HTTP Host header to localhost could grant access to critical pages, enabling unauthenticated remote setup and subsequent abusive use of the antivirus configuration feature to execute code as SYSTEM.