Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Gladinet

First CVE: Mar 31, 2023Active for: 3 yearsTotal CVEs: 12
93.8
VTI Score
TOP TARGET

Gladinet maintains a narrow portfolio of cloud storage and file-sync products, CentreStack and Triofox, that serve as on-premises or hybrid data gateways and are often exposed to internet access. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and have a strong, recurring history of confirmed in-the-wild exploitation, coupled with frequent public exploit availability, driven by the high-value, authentication-adjacent attack surface represented by cloud-gateway and credential-management roles. The exposure recurs across these products through hard-coded credentials, world-accessible files and directories, improper access control, and unrestricted dangerous-file uploads—authentication and configuration weaknesses that directly compromise data confidentiality and governance in hybrid environments. Current exploitation activity, severity breakdown, and exposure counts are shown alongside this summary.

FAUCET AI Generated
12
Total CVEs
More Total CVEs than 93% of tracked vendors
2.0
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 80% of tracked vendors
8.8
Avg CVSS Score
Higher Avg CVSS Score than 84% of tracked vendors
33.3%
In CISA KEV
Higher KEV Rate than 100% of tracked vendors

Trends Over Time

The number and severity of CVEs published that impact products developed by Gladinet over time

Volume of CVEsAvg CVSS Base Score
First CVE
Mar 31, 2023
3 years ago
Most Recent CVE
May 27, 2026
60 days ago

Products(2 total)

Top CVEs

Signals from CVEs in this vendor scope (12 CVEs).

12 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2025-11371HIGH
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system
Oct 9, 20257.598YESYES
CVE-2025-30406CRITICAL
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited
Apr 3, 20259.898YESYES
CVE-2025-12480CRITICAL
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
Nov 10, 20259.197YESYES
CVE-2025-14611CRITICAL
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public expose
Dec 12, 20259.896YESYES
CVE-2026-8362CRITICAL
A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long URL path starting with /woshome
May 27, 20269.835NONO
CVE-2026-8363CRITICAL
A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing a long URL path starting with /resources:
May 27, 20269.835NONO
CVE-2026-8364CRITICAL
Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes remote HTTP messages with URL paths starting with /resources,
May 27, 20269.835NONO
CVE-2023-26829CRITICAL
An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to set a new password for any valid user acc
Mar 31, 20239.831NONO
CVE-2026-8359HIGH
When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin_LoadHttpModule function
May 27, 20267.528NONO
CVE-2026-8360HIGH
Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, WOSWebDavModule.dll) can return a NULL pointer (i.e., when no use
May 27, 20267.528NONO
View all 12 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products12 CVEs
42%
58%
Severity distribution among all CVEs352,719 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local0 (0.0%)
Network12 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None12 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High1 (8.3%)
None11 (91.7%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (12 CVEs).

CISA KEV
4 CVEs
33.3% of CVEs· 100th percentile
Metasploit
3 CVEs
25.0% of CVEs· 99th percentile
Nuclei
4 CVEs
33.3% of CVEs· 98th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Gladinet.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Gladinet — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Gladinet's Products

View all 4 CNAs →

Top CWEs