CVE-2025-12480: Gladinet Triofox improper access control exposes setup pages

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable access control bypass with CVSS 9.1, CISA KEV listing, and EPSS above 0.90 makes this an urgent patch-or-isolate case.

What it is

Triofox versions before 16.7.10368.56560 leave initial setup pages reachable after setup is complete due to improper access control (CWE-284). Because those pages are unauthenticated and network reachable, an attacker can reach configuration functionality that should be closed off, and the flaw is already in CISA KEV with a very high EPSS score.

Impact

An attacker gains unauthenticated access to setup and configuration pages, which can lead to changing or hijacking instance settings and potentially full compromise of confidentiality and integrity. Availability is not scored as affected by the CVSS vector.

Attack surface

Reachable over the network via HTTP(S) with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed or internally reachable Triofox instance running a version before 16.7.10368.56560 is in scope.

Exploitation

Listed in CISA KEV on 2025-11-12 with a remediation due date of 2025-12-03, and a Google/Mandiant reference is tagged as an exploit source. EPSS 30-day probability is 0.90532 (99.8th percentile), indicating active exploitation is expected.

What to do

• Upgrade Triofox to 16.7.10368.56560 or later per the vendor release history.
• If immediate patching is not possible, remove Triofox from internet exposure or discontinue use, as directed by the CISA KEV required action.
• Restrict network access to the Triofox management and setup endpoints to trusted administrative networks only.
• Review Triofox configuration and accounts for unauthorized changes made through setup pages, and rotate any credentials or keys stored there.
• Track the CISA KEV due date of 2025-12-03 to confirm remediation is completed.

Detection

• Hunt web logs for requests to Triofox initial setup or installation paths from unauthenticated or unexpected source IPs.
• Alert on access to setup pages after the instance has completed initial configuration.
• Monitor for configuration changes, new administrative accounts, or unexpected outbound connections from the Triofox host.
• Correlate Triofox access logs with the known exploitation activity described in the Google Threat Intelligence and Mandiant references.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.