critical9.1Known exploited
CVE-2025-12480
Gladinet Triofox Improper Access Control Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-11-12. Federal due date: 2025-12-03.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gladinet | Triofox | before 16.7.10368.56560 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://access.triofox.com/releases_history/
- https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0008.md
- https://www.triofox.com/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-12480