A newly discovered zero-day vulnerability in Gladinet’s Triofox file-sharing and remote access platform, tracked as CVE‑2025‑12480, has been exploited in the wild by a threat group identified as UNC6485, according to research from VulnCheck and Mandiant.
The flaw, rated critical, allows unauthenticated remote code execution (RCE) through a complex chain of web requests that attackers used to obtain SYSTEM-level access on vulnerable servers.
Authentication Bypass Leads to Admin Access
The vulnerability stems from a local host header injection issue that allows remote attackers to impersonate localhost and access Triofox’s initial configuration pages.
Generally reserved for local administrators, these pages allow database setup and the initialization of admin accounts.
By exploiting this flaw, threat actors can create a new administrative account through endpoints such as AdminDatabase.aspx, AdminAccount.aspx, and InitAccount.aspx.
VulnCheck’s researchers reproduced the exploitation path described by Mandiant and found it far more complex than public summaries suggest.
The attack involves more than 20 chained HTTP requests, each step of which maintains intricate ASP.NET state variables such as __VIEWSTATE.
These requests are essential for transitioning through the setup workflow, culminating in administrative access control and configuration changes.
To fully emulate the attack, the VulnCheck team embedded an entire PostgreSQL server within their exploit using the Go embedded-postgres library.
This simulated the attacker’s ability to supply a rogue database server used during the admin reinitialization process.
The team’s analysis also confirmed that exploitation required precise handling of Triofox’s configuration states to avoid leaving evidence or disrupting the application’s functionality.
Abusing Antivirus Features for Code Execution
Once they obtained administrative privileges, the attackers executed remote code by abusing Triofox’s built-in antivirus configuration.
Using the administration panel, they uploaded malicious script files and modified antivirus scan parameters to point toward these payloads. This feature, intended for scanning uploaded files, was exploited as a command-execution vector.
VulnCheck found that enabling the “Personal Home Drive” setting allowed attackers to upload malicious files locally without requiring extra permissions. The payloads were typically VBScript and batch files that, when scanned by the antivirus engine, triggered the execution chain and delivered a remote shell.
The proof-of-concept exploit built by VulnCheck successfully obtained SYSTEM access on Triofox version 16.4.10317.56372, confirming that the same attack path could be replicated.
Researchers emphasize that while post-exploitation summaries may simplify the process, real-world exploitation of CVE‑2025‑12480 demands sophisticated state management, custom infrastructure setup, and multi-stage web interactions.
Gladinet has since released patches to address the flaw, and users are strongly advised to update their systems immediately and review them for signs of compromise.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
