CVE-2025-12480
Last modified
CVE-2025-12480 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.. CISA has confirmed active exploitation in the wild. EPSS estimates a 90.35% chance of exploitation in the next 30 days.
Description
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gladinet | Triofox | < 16.7.10368.56560 |
References
- https://access.triofox.com/releases_history/Release Notes
- https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-12480Exploit, Third Party Advisory
- https://www.triofox.com/Product
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-12480US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-12480?
How severe is CVE-2025-12480?
How do I fix CVE-2025-12480?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-12474A specially-crafted file can cause libjxl's decoder to read …4.4
- CVE-2025-12475The Blocksy Companion plugin for WordPress is vulnerable to …6.4
- CVE-2025-12476Resource Lacking AuthN.This issue affects BLU-IC2: through 1…9.8
- CVE-2025-12477Server Version Disclosure.This issue affects BLU-IC2: throug…9.8
- CVE-2025-12478Non-Compliant TLS Configuration.This issue affects BLU-IC2: …9.8
- CVE-2025-12479Systemic Lack of Cross-Site Request Forgery (CSRF) Token Imp…8.8
- CVE-2025-12481The WP Duplicate Page plugin for WordPress is vulnerable to …4.3
- CVE-2025-12482The Booking for Appointments and Events Calendar – Amelia pl…7.5
- CVE-2025-12483The Visualizer: Tables and Charts Manager for WordPress plug…6.5
- CVE-2025-12484The Giveaways and Contests by RafflePress – Get More Website…7.2
- CVE-2025-12485Improper privilege management during pre-MFA cookie handling…8.8
- CVE-2025-12486Heimdall Data Database Proxy Cross-Site Scripting Remote Cod…8.8
Are you affected by CVE-2025-12480?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST