Gladinet CentreStack and Triofox Flaw Exploited to Steal Machine Keys
Summary
Huntress observed attackers exploit an unauthenticated file-inclusion flaw in CentreStack and Triofox to retrieve a machine key and attempt remote code execution. Gladinet released a CentreStack patch on October 14, 2025.
Key points
- Huntress reported in-the-wild exploitation of CVE-2025-11371 affecting Gladinet CentreStack and Triofox, with three customers impacted so far.
- An unauthenticated request to the exposed temporary-download handler exploited directory traversal to retrieve the application’s Web.config file and machine key.
- Attackers used the key in a ViewState deserialization attack and ran reconnaissance commands, including ipconfig /all.
- Huntress said its investigation found the activity on September 26, 2025; analysts contained the host and prevented further malicious activity.
- Gladinet released CentreStack version 16.10.10408.56683 with a fix on October 14. Huntress recommends updating to the latest build.
- As an interim mitigation, Huntress recommended disabling the temp handler in UploadDownloadProxy’s Web.config, noting that this affects some platform functionality.
Article Details
- Vulnerability Types
- Unauthenticated local file inclusion
- ViewState deserialization vulnerability
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Disable the temp handler for t.dn in C:\Program Files (x86)\Gladinet Cloud Enterprise\UploadDownloadProxy\Web.config; the article notes this will affect some platform functionality.
MITRE ATT&CK
T1059.003 · Windows Command ShellCommands including ipconfig /all were executed on the Windows host through the ViewState deserialization attack.T1082 · System Information DiscoveryThe attacker ran ipconfig /all to gather system information from the compromised host.T1190 · Exploit Public-Facing ApplicationThe attacker exploited an unauthenticated local file inclusion flaw exposed through Gladinet's externally accessible /storage/t.dn endpoint.