Gladinet Triofox Improper Access Control Vulnerability

CRITICAL 9.1EXPLOITED (CISA KEV)CVE-2025-12480 · Published 10/11/2025 · updated 19/10/2026

Gladinet Triofox Improper Access Control Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 12/11/2025. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
triofox gladinet	`< 16.7.10368.56560`	`16.7.10368.56560`

Description

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

References

access.triofox.com/releases_history · Release Notes
cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480 · Exploit
mandiant/Vulnerability-Disclosures · Third Party Advisory
triofox.com · Product
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2025-12480

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free