CISA KEV Alert: Two Critical Flaws Under Active Exploitation, Including Gladinet LFI/RCE and CWP Admin Takeover

According to The U.S. Cybersecurity and Infrastructure Security Agency (CISA), two vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. The first, CVE-2025-11371 (CVSS 7.5), affects Gladinet CentreStack and Triofox and enables a Local File Inclusion flaw that unauthenticated attackers can use to read sensitive files and, via a bystander deserialization chain, achieve remote code execution.

Security researchers described a multi-stage attack that involves reading files, extracting the machineKey, crafting valid ViewState payloads, and ultimately executing commands on the server. The second flaw, CVE-2025-48703 (CVSS 9.0), targets Control Web Panel and allows unauthenticated remote command execution through an unsanitised t_total parameter in a filemanager changePerm request, with authentication bypass typically occurring on port 2083.

CISA noted the flaws pose significant risks to federal systems, with a patch for CWP released in version 0.9.8.1205 in June, and federal agencies ordered to patch by 25 November 2025 to mitigate ongoing attacks. May 13, 2025 was the disclosure date for the CWP vulnerability.