Gladinet Triofox Improper Access Control (CVE-2025-12480)

critical Nessus Plugin ID 276656

Language:

Synopsis

The remote host has an application installed is affected by a vulnerability.

Description

The Gladinet Triofox prior to version 16.7.10368.56560. It is, therefore, are vulnerable to an Improper Access Control flaw.

This vulnerability in Gladinet’s Triofox (versions before 16.7.10368.56560) that lets unauthenticated attackers bypass authentication (via a host-header spoof to “localhost”), access initial setup/admin configuration pages, create their own admin account, and ultimately abuse Triofox’s built-in antivirus feature to upload and run arbitrary code as SYSTEM.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update Gladinet Triofox to version 16.7.10368.56560 or later.

Plugin Details

Severity: Critical

ID: 276656

File Name: gladinet_triofox_CVE-2025-12480.nasl

Version: 1.2

Type: local

Agent: windows

Family: Windows

Published: 11/24/2025

Updated: 12/4/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:gladinet:triofox

Required KB Items: installed_sw/Gladinet Triofox

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/10/2025

Vulnerability Publication Date: 11/10/2025

CISA Known Exploited Vulnerability Due Dates: 12/3/2025

Reference Information

CVE: CVE-2025-12480

Detections

Analytics