CVE-2025-14611: Gladinet CentreStack/Triofox -- Hardcoded Cryptographic Keys

Background

Gladinet CentreStack and Triofox are enterprise cloud storage and file-sharing platforms that provide secure remote file access — roughly comparable to SharePoint or Dropbox for private cloud deployments. Both are commonly deployed as internet-facing portals with access to sensitive corporate data.

CVE-2025-14611 is a hardcoded AES cryptographic key vulnerability (CWE-798) present across all CentreStack and Triofox deployments. When every installation uses the same key, an attacker who obtains it — through reverse engineering the binary or via public disclosure — can forge cryptographic tokens, decrypt protected communications, or craft requests that bypass authentication and access arbitrary local files.

CISA added this to the KEV catalog on 2025-12-15. Hardcoded keys in file-sharing platforms are especially damaging because they can enable unauthenticated access to all data the platform manages.

Technical Mechanism

CWE-798 (Use of Hard-coded Credentials) here manifests as fixed AES encryption keys embedded in the application that are shared across all customer deployments. A properly secured system would use per-instance generated keys stored in a protected key store.

// Vulnerable pattern: hardcoded cryptographic key in .NET application
public class CryptoHelper {
    // Bug: same key in every installation; discoverable via decompilation
    private static readonly byte[] AesKey = Convert.FromBase64String(
        "dGhpc2lzYWhhcmRjb2RlZGtleXRoYXRzaG91bGRub3RiZWhlcmU="
    );

    public static string DecryptToken(string encryptedToken) {
        return AesDecrypt(encryptedToken, AesKey);
    }

    public static string ForgeToken(string payload) {
        return AesEncrypt(payload, AesKey); // attacker can forge valid tokens
    }
}

With the known key, an attacker can forge authentication tokens or craft requests that the server decrypts and treats as legitimate, bypassing authentication gates to request arbitrary local files through the application’s file access endpoints.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. Gladinet platforms store corporate intellectual property, employee data, and sensitive documents. File-sharing platforms are high-value ransomware targets — pre-encryption data theft is standard practice for ransomware operators, and unauthenticated file access makes this a particularly efficient vector for exfiltration.

Impact Assessment

• Unauthenticated local file inclusion via forged cryptographic tokens
• Access to all files managed by the CentreStack/Triofox deployment
• Exposure of server configuration files and stored credentials
• Potential for lateral movement using credentials extracted from config files
• Data theft enabling ransomware double-extortion scenarios

Affected Versions

Remediation Steps

1. Apply Gladinet’s security patch immediately to replace hardcoded keys with per-instance generated keys.
2. After patching, regenerate all cryptographic keys and invalidate existing sessions and tokens.
3. Audit access logs for anomalous file access patterns prior to patching.
4. Restrict access to CentreStack/Triofox portals to known IP ranges via WAF or firewall if possible.
5. Enable multi-factor authentication for all platform users.
6. Review files accessible to the platform for sensitive credentials that may have been exposed.

Detection Guidance

Log Sources: Web application logs, file access audit trails, network proxy logs.

IOCs: Requests to file endpoints with unexpected or malformed authentication tokens; bulk file access from single sessions; access to configuration files or system paths via file download endpoints.

Sigma rule:

title: Gladinet CentreStack Unauthenticated File Access CVE-2025-14611
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - '/filedownload'
      - '/getfile'
    cs-uri-query|contains:
      - '../'
      - '%2e%2e'
      - '/etc/'
      - '/windows/system32'
  condition: selection
level: critical

Timeline

References

• NVD — CVE-2025-14611
• CISA KEV — CVE-2025-14611
• MITRE CVE — CVE-2025-14611