Exploitation of Triofox Vulnerability CVE-2025-12480: A Deep Dive

A critical vulnerability in Gladinet's Triofox file-sharing and remote access platform, tracked as CVE-2025-12480, has been actively exploited by the threat actor group UNC6485 since August 24, 2025. This flaw, which has a CVSS score of 9.1, allows unauthenticated attackers to bypass authentication controls and gain access to sensitive configuration pages, enabling them to upload and execute arbitrary code with system-level privileges.

Triofox 0-Day Abuse of Anti-Virus Function Enables Remote Payload ExecutionHackers Exploit Triofox 0-Day to Deploy Malicious Payloads Using Anti-Virus FeatureMandiant Uncovers Active Exploitation of Triofox Vulnerability Allowing Remote Code ExecutionHackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus FeatureAttackers exploited another Gladinet Triofox vulnerability (CVE-2025-12480)Critical Triofox bug exploited to run malicious payloads via AV configurationCVE-2025-12480 Detection: Hackers Exploit the Now-Patched Unauthenticated Access Control Vulnerability in Gladinet’s TriofoxTriofox Unauthenticated Access Flaw, Chained with AV Scanning Feature Abuse to Deploy Remote Access ToolsHackers Exploit Critical Flaw in Triofox File Sharing ProductGoogle finds Triofox zero-day, Gladinet's third this year

The exploitation process involves manipulating HTTP host headers. Attackers spoof the host header to "localhost," which allows them to bypass security checks and access restricted configuration pages. Once inside, they create a new administrative account named "Cluster Admin" through the compromised setup interface. This account is then used to upload malicious files, leveraging Triofox's built-in antivirus feature to execute these payloads.

Critical Triofox bug exploited to run malicious payloads via AV configurationHackers Exploit Triofox 0-Day to Deploy Malicious Payloads Using Anti-Virus FeatureTriofox 0-Day Abuse of Anti-Virus Function Enables Remote Payload ExecutionCVE-2025-12480 Detection: Hackers Exploit the Now-Patched Unauthenticated Access Control Vulnerability in Gladinet’s TriofoxHackers Exploit Critical Flaw in Triofox File Sharing ProductMandiant Uncovers Active Exploitation of Triofox Vulnerability Allowing Remote Code ExecutionHackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus FeatureAttackers exploited another Gladinet Triofox vulnerability (CVE-2025-12480)Triofox Unauthenticated Access Flaw, Chained with AV Scanning Feature Abuse to Deploy Remote Access Tools

The attackers specifically exploit a weakness in the CanRunCriticalPage() function, which fails to validate the origin of requests. This oversight permits remote attackers to spoof their source IP address and gain unauthorized access. Following the creation of the Cluster Admin account, attackers configure the antivirus path to point to their malicious batch script, which is executed with SYSTEM account privileges.

Hackers Exploit Critical Flaw in Triofox File Sharing Product

Once the attackers gain access, they deploy legitimate remote access tools, including Zoho Unified Endpoint Management System (UEMS), Zoho Assist, and AnyDesk. These tools facilitate reconnaissance activities, such as enumerating active sessions and user accounts, changing passwords, and adding compromised accounts to local administrators and the "Domain Admins" group for privilege escalation. To maintain persistent access, they establish encrypted SSH tunnels using tools like Plink and PuTTY.

Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

Mandiant has strongly advised organizations using Triofox to upgrade to version 16.7.10368.56560 or later, which patches the vulnerability. They recommend auditing all administrator accounts for unauthorized entries, verifying antivirus configurations to prevent unauthorized script execution, and monitoring for unusual outbound SSH traffic to detect ongoing compromises.

Hackers Exploit Triofox 0-Day to Deploy Malicious Payloads Using Anti-Virus Feature

While the vulnerability has been patched, the incident highlights significant concerns regarding the security of file-sharing platforms. Critics argue that the reliance on built-in antivirus features without adequate validation can lead to severe security breaches. The ongoing exploitation of Triofox vulnerabilities, including CVE-2025-30406 and CVE-2025-11371 earlier this year, raises questions about the robustness of Gladinet's security measures.

CVE-2025-12480 Detection: Hackers Exploit the Now-Patched Unauthenticated Access Control Vulnerability in Gladinet’s TriofoxAttackers exploited another Gladinet Triofox vulnerability (CVE-2025-12480)Google finds Triofox zero-day, Gladinet's third this yearTriofox Unauthenticated Access Flaw, Chained with AV Scanning Feature Abuse to Deploy Remote Access ToolsHackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus FeatureMandiant Uncovers Active Exploitation of Triofox Vulnerability Allowing Remote Code ExecutionTriofox 0-Day Abuse of Anti-Virus Function Enables Remote Payload ExecutionHackers Exploit Triofox 0-Day to Deploy Malicious Payloads Using Anti-Virus Feature

There are discrepancies regarding the severity of CVE-2025-12480, with some sources reporting a CVSS score of 9.8, while others cite 9.1. Additionally, the ultimate motive behind the exploitation remains unclear, with speculation ranging from data theft to cyber-espionage.

CVE-2025-12480 Detection: Hackers Exploit the Now-Patched Unauthenticated Access Control Vulnerability in Gladinet’s Triofox

• “To achieve code execution, the attacker logged in using the newly created Admin account. The attacker uploaded malicious files to execute them using the built-in antivirus feature,” — Stallone D'Souza, Security Researcher

Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

• “ “The investigation revealed an unauthenticated access vulnerability that allowed access to configuration pages.” — Mandiant Report

Hackers Exploit Critical Flaw in Triofox File Sharing Product

• “This incident serves as a crucial reminder that even security-focused features can be weaponized if not properly implemented and hardened against manipulation.” — Mandiant Analysis

Triofox Unauthenticated Access Flaw, Chained with AV Scanning Feature Abuse to Deploy Remote Access Tools

The exploitation of CVE-2025-12480 underscores the importance of timely patching and rigorous security practices in the face of evolving cyber threats. Organizations must remain vigilant and proactive in their cybersecurity measures to mitigate risks associated with vulnerabilities in widely used software platforms.

CVE-2025-12480 Detection: Hackers Exploit the Now-Patched Unauthenticated Access Control Vulnerability in Gladinet’s Triofox