Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

The Gladinet Triofox running on the remote host is affected by an improper access control vulnerability.

Gladinet Triofox version prior to 16.7.10368.56560 are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

The Gladinet Triofox prior to version 16.7.10368.56560. It is, therefore, are vulnerable to an Improper Access Control flaw.

This vulnerability in Gladinet’s Triofox (versions before 16.7.10368.56560) that lets unauthenticated attackers bypass authentication (via a host-header spoof to “localhost”), access initial setup/admin configuration pages, create their own admin account, and ultimately abuse Triofox’s built-in antivirus feature to upload and run arbitrary code as SYSTEM.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
299781	Gladinet Triofox Improper Access Control (CVE-2025-12480) (uncredentialed check)	Nessus	Misc.	critical
115076	Gladinet Triofox < 16.7.10368.56560 Improper Access Control	Web App Scanning	Component Vulnerability	critical
276656	Gladinet Triofox Improper Access Control (CVE-2025-12480)	Nessus	Windows	critical

Detections

Analytics

CVE-2025-12480

critical

Tenable Plugins

critical

critical

critical