A critical authentication bypass vulnerability in Gladinet’s Triofox file-sharing platform is being actively exploited by a threat group, enabling attackers to achieve full, high-privilege remote code execution on target servers.
The vulnerability, tracked as CVE-2025-12480, holds a CVSS score of 9.1 (Critical). Google’s Mandiant Threat Defense group, which discovered the flaw, warned that a threat cluster it tracks as UNC6485 has been exploiting the vulnerability as a zero-day since at least August 24, 2025.
Triofox is an enterprise software platform that provides secure remote access and file sharing, often integrating with existing on-premise file servers to web-enable them. The vulnerability’s nature as an authentication bypass makes it a devastating entry point for attackers, as it requires no credentials to exploit.
A Two-Stage Exploit
According to Mandiant’s detailed analysis, the attack is a two-stage process that leverages a clever manipulation of HTTP host headers. First, the attacker sends a specially crafted web request to the Triofox server, modifying the HTTP Host header field to “localhost”. This trick bypasses the CanRunCriticalPage() function, a security check that improperly trusts the unvalidated host header.
This initial bypass grants the unauthenticated attacker access to the server’s initial setup and configuration pages, such as AdminDatabase.aspx, which are supposed to be locked after installation.
From there, the attacker carries out the second stage of the assault. They use the exposed setup pages to create a new, native administrator account on the Triofox platform, which Mandiant observed was often named “Cluster Admin”.
Once logged in as an administrator, the attacker abuses a legitimate, built-in feature: the antivirus configuration. The Triofox platform allows administrators to specify an arbitrary path for a custom antivirus engine. UNC6485 exploits this by changing the engine’s path to a malicious batch script (e.g., centre_report.bat) or other payload they have uploaded. When the system attempts to run the antivirus scan, it instead executes the attacker’s script.
Because the Triofox parent process runs with the highest possible privileges, the malicious script is executed as NT AUTHORITY\SYSTEM, giving the attacker complete control over the underlying server.
Post-Exploitation Activity
Mandiant observed UNC6485 using this access to deploy legitimate remote access tools like Zoho Unified Endpoint Management System (UEMS), Zoho Assist, and AnyDesk. They then used these tools for post-exploitation activities, including enumerating network shares, attempting to escalate privileges to Domain Admins, and downloading tools like Plink and PuTTY to set up encrypted SSH tunnels for covert command-and-control (C2) traffic.
Gladinet was notified of the vulnerability and released a patch in version 16.7.10368.56560. All Triofox administrators are urged to upgrade immediately and audit their systems for unauthorized admin accounts or suspicious antivirus engine configurations.
Sources: Google Cloud Threat Intelligence (Mandiant), NVD CVE-2025-12480.
—
By the ID Tech Editorial Team
