From LFI to RCE: Active Exploitation Detected in Gladinet and TrioFox Vulnerability

According to Huntress, active in-the-wild exploitation of an unpatched flaw affecting Gladinet CentreStack and TrioFox has been observed, tracked as CVE-2025-11371 with a CVSS score of 6.1. The zero-day flaw is an unauthenticated local file inclusion bug that can disclose system files and was first detected on 27 September 2025, with three of Huntress’s customers reported affected so far.

The vulnerability affects all versions prior to and including 16.7.10368.56560, and is linked to a remote code execution risk via a ViewState deserialization vulnerability tied to a previously noted CVE-2025-30406 hard-coded machine key.

For interim protection, Huntress recommends disabling the "temp" handler within the Web.config file for UploadDownloadProxy located at C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config, noting that this may impact some functionality until a patch is released.