CVE-2025-12480CampaignPublished 10 Nov 2025Updated 10 Dec 2025

Unauthenticated Remote Access via Triofox Vulnerability CVE-2025-12480

Affects Gladinet TriofoxSource AlienVault OTX General

Authoritative record:CVE-2025-12480· Critical 9.1

Exploited in the wild · KEV due 3 Dec 2025 · public detection template (Nuclei) · 95% EPSS : block it and hunt for it in your logs now.

Data as of 26 Oct 2026, 06:26 UTC

CVSS base score

9.1Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 3 Dec 2025 US federal agencies must patch by this date; a sensible deadline for everyone else.
EPSS: 95.7% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 10 Nov 2025
Detectable: evidence found.
nuclei template: Triofox - Improper Access Control
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 2 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE published
on cve.org
2025-11-1014:20Z, t = 0
Added to CISA KEV (opens in a new tab)
exploitation confirmed
2025-11-12, 2 days after disclosure
In Threat Radar
record ingested
2025-11-1300:00Z, 3 days after disclosure
KEV remediation due
US federal deadline
2025-12-03, 23 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Gladinet Triofox to 16.7.10368.56560.

Affected software

Product	Affected	Fixed in
TrioFoxTrioFox	Affected <16.7.10368.56560	Fixed in 16.7.10368.56560

Description

A critical vulnerability in Gladinet's Triofox file-sharing platform, CVE-2025-12480, allowed unauthenticated access to configuration pages, enabling arbitrary payload execution. Threat actor UNC6485 exploited this flaw as early as August 24, 2025, bypassing authentication and chaining it with anti-virus feature abuse for code execution. The vulnerability affected Triofox version 16.4.10317.56372 and was patched in version 16.7.10368.56560. Attackers created admin accounts, deployed remote access tools, conducted reconnaissance, and attempted privilege escalation. They used Zoho UEMS, Zoho Assist, and Anydesk for remote access, and set up encrypted tunnels for C2 communication. The exploit chain involved HTTP host header manipulation and abuse of the built-in anti-virus feature to execute malicious scripts.

Impact

For European organizations, this vulnerability poses a significant risk to confidentiality, integrity, and availability of sensitive data shared via Triofox. Unauthorized administrative access allows attackers to manipulate configurations, deploy persistent remote access tools, and potentially move laterally within networks. The ability to execute arbitrary code without authentication can lead to data exfiltration, ransomware deployment, or disruption of business operations. Organizations in sectors such as finance, healthcare, government, and critical infrastructure that use Triofox for file sharing are particularly vulnerable. The exploitation could undermine trust in file-sharing platforms and cause regulatory compliance issues under GDPR due to potential data breaches. The use of encrypted tunnels for command-and-control complicates detection and response, increasing the risk of prolonged undetected intrusions. The medium severity rating may underestimate the real-world impact given the ease of exploitation and the critical nature of the access gained.

Defensive guidance

European organizations should immediately verify their Triofox version and upgrade to version 16.7.10368.56560 or later to patch CVE-2025-12480. Network segmentation should be enforced to limit access to Triofox servers, and strict firewall rules should restrict inbound traffic to trusted sources. Implement robust monitoring for unusual HTTP host header values and suspicious anti-virus feature activity indicative of exploitation attempts. Deploy endpoint detection and response (EDR) solutions to detect the use of remote access tools like Zoho UEMS, Zoho Assist, and AnyDesk, especially if installed without authorization. Conduct regular audits of administrative accounts on Triofox to identify unauthorized creations. Employ multi-factor authentication (MFA) on all administrative interfaces where possible, even if the vulnerability bypasses authentication, to add defense in depth. Incident response plans should include procedures for isolating compromised systems and analyzing encrypted tunnels for command-and-control traffic. Finally, raise user awareness about the risks of unauthorized remote access tools and ensure timely application of security patches.

CWE-284Improper Access Control (opens in a new tab)
Pillar weaknessCWE Top 25 (2025): #19OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
Virtual Patching (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
V1.10.1 (opens in a new tab)
Attack patterns
Embedding Scripts within Scripts (opens in a new tab)
Modification of Windows Service Configuration (opens in a new tab)
Malicious Root Certificate (opens in a new tab)
Intent Spoof (opens in a new tab)
WebView Exposure (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

Indicators of compromise

URLs 2

http://84.200.80.252/SAgentInstaller_16.7.10368.56560.zip
http://84.200.80.252/SAgentInstaller_16.7.10368.56560.zip'

IP addresses 1

216.107.136.46

Hashes 10

269ce7b3a3fcdf735cd8a37c04abfdae
36e31f610eef3223154e6e8fd074190f
803278de3514dbf83a5b6f39c99f4000
1f2800382cd71163c10e5ce0a32b60297489fbb5
46ddfbbb5b4193279b9e024a5d013f5d825fcdf5
481aae12b0abc29fa19f6b7af5d66ef6f811e999
16cbe40fb24ce2d422afddb5a90a5801ced32ef52c22c2fc77b25a90837f28ad
43c455274d41e58132be7f66139566a941190ceba46082eb2ad7a6a261bfd63f
50479953865b30775056441b10fdcb984126ba4f98af4f64756902a807b453e7
ac7f226bdf1c6750afa6a03da2b483eee2ef02cd9c2d6af71ea7c6a9a4eace2f

CVEs 1

CVE-2025-12480

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Nov 2025, 10:01 UTC

Public exploits and detectiona Nuclei detection template

WeaknessesCWE-284

MITRE ATT&CK techniques17 from threat tags

Technical details