CVE-2025-12480 is a critical authentication bypass vulnerability in TrioFox file sharing platforms that allows unauthenticated attackers to access administrative setup pages. The vulnerability is being actively exploited in the wild and has been added to CISA's KEV catalog.
Data Source: CIRCL
Confidence: HIGH
Exploitation Method: DIRECT_NETWORK
CVE Published: 2025-11-10
Added to CISA KEV: 2025-11-12 2 DAYS BETWEEN CVE AND KEV
CVE-2025-12480 is a critical authentication bypass vulnerability (CVSS score: 9.1) affecting Gladinet's Triofox file-sharing and remote access platform versions prior to 16.7.10368.56560. The vulnerability was discovered in August 2025 and allows unauthenticated attackers to bypass authentication and access the application's configuration pages. The flaw was actively exploited by a threat ...
Google’s Mandiant confirmed active exploitation of CVE-2025-12480, a critical authentication bypass flaw in Gladinet’s Triofox platform. The vulnerability allows unauthorized admin access and remote code execution, with attackers deploying backdoors and Cobalt Strike payloads against unpatched enterprise environments.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The vulnerabilities in question are listed below - CVE-2025-11371 (CVSS score: 7.5) - A vulnerability in files or directories accessible to ...
CVE-2025-12480 exploitation and attack details. Gladinet’s Triofox solution is used by medium and large businesses to securely share files and allow users to access them without a VPN.The attackers exploited CVE-2025-12480 on a server running Triofox v16.4.10317.56372, which was released in April 2025 to fix CVE-2025-30406, a deserialization vulnerability affecting Triofox and Gladinet’s MSP-friendly file sharing platform CentreStack. According to its NVD entry, CVE-2025-30406 was exploited as a zero-day beginning in March 2025.
24, 2025, a threat cluster tracked by Google Threat Intelligence Group (GTIG) as UNC6485 exploited the unauthenticated access vulnerability and ...