CVE-2025-11371

This vulnerability lets someone who can reach your CentreStack/TrioFox server “trick” it into revealing files that are stored locally on the computer—without needing a username or password. It’s like leaving a file cabinet unlocked through a hidden door on the building’s public hallway: an attacker may be able to grab sensitive system details, which can then be used for further attacks.

This matters if your small business uses Gladinet CentreStack and/or TrioFox for file storage, hosting, or related server-side functions. Because the flaw does not require authentication and is reachable in default configurations, it is mainly a “can an attacker reach it over the network?” question.
Reachability gate: treat it as a real risk if the service is reachable from untrusted networks (for example, the internet or other networks attackers may access).

This is RED because attackers can exploit it remotely without a login to read sensitive files, and it is confirmed as a required action in CISA’s KEV list. Additionally, a public exploit exists, and exploitation/interest has been reported publicly and is described as being exploited in the wild in the findings.
Action is required now: upgrade to the fixed version or apply the vendor’s temporary mitigation while you work toward upgrading.