Critical Cryptographic Vulnerability in Gladinet CentreStack and Triofox

What changed

Gladinet has disclosed a critical vulnerability affecting its CentreStack and Triofox products. The issue stems from the use of hardcoded values in the implementation of the AES cryptoscheme, which compromises the security of public-facing endpoints.

This vulnerability not only weakens encryption but also poses a risk of arbitrary local file inclusion when an attacker sends a specially crafted request without authentication.

Who is affected

Organizations utilizing Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 are at risk due to this vulnerability. The impact is particularly concerning for those with public-facing applications that rely on these products.

The following groups should take immediate notice:

• Users of Gladinet CentreStack
• Users of Gladinet Triofox
• Organizations that deploy these solutions in cloud environments
• IT security teams responsible for maintaining application security

What to do

It is crucial for affected organizations to take immediate action to mitigate the risks associated with this vulnerability. Upgrading to the latest version of Gladinet CentreStack and Triofox is highly recommended to eliminate the hardcoded cryptographic values.

In addition, organizations should review their security policies and practices to ensure that they are not exposing sensitive data through public endpoints.

• Upgrade to Gladinet CentreStack and Triofox version 16.12.10420.56791 or later.
• Conduct a security audit of public-facing applications using these products.
• Implement additional security measures to monitor and protect against unauthorized access.