Gladinet CentreStack and Triofox 0-Day Flaw Under Active Attack

Gladinet CentreStack and Triofox have come under active attack, with threat actors exploiting an unauthenticated local file inclusion flaw tracked as CVE-2025-11371. The flaw lets attackers read sensitive files without logging in, enabling them to fetch the Web.config and extract the machine key, after which the old view state deserialization method can be used to deploy remote code execution on the server.

A zero‑day is being exploited in the wild, with Huntress’s security operations centre detecting successful exploitation against CentreStack instances on 27 September 2025, and at least three customers reported in‑the‑wild abuse, according to Huntress. The affected versions are later than 16.4.10315.56368, which no longer suffer from the earlier CVE-2025-30406 deserialization flaw, and there is no official patch yet; administrators are urged to apply a workaround immediately.

The suggested mitigation is to disable the temp handler entry in the UploadDownloadProxy Web.config file (C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config) to block the t[.]dn endpoint, with a restart of the web service afterwards. Gladinet has acknowledged the vulnerability and is communicating with impacted clients as a patch is expected soon, according to Huntress.