CVE-2025-12480
Published: 10 November 2025
Description
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources, directly preventing unauthorized remote access to initial setup pages after completion.
Establishes secure configuration settings to disable or restrict access to setup interfaces post-initialization, mitigating the improper access control flaw.
Applies least privilege to limit access to sensitive setup functions only to necessary initial configuration activities.
Security SummaryAI
CVE-2025-12480 is an Improper Access Control vulnerability (CWE-284) affecting Triofox versions prior to 16.7.10368.56560. The flaw enables unauthorized access to initial setup pages even after the setup process has been completed. It carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
A remote, unauthenticated attacker can exploit this vulnerability over the network to access the setup pages, achieving high impacts on confidentiality and integrity with no availability disruption. Exploitation allows manipulation of sensitive setup functions post-initialization, potentially enabling unauthorized configuration changes or administrative control.
Advisories from Mandiant (MNDT-2025-0008), Google Cloud Threat Intelligence, Triofox release history, and the vendor site outline the issue and remediation. Triofox addresses the vulnerability in version 16.7.10368.56560 and later. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-12480 to its Known Exploited Vulnerabilities Catalog, signaling active real-world exploitation and urging federal agencies to apply mitigations immediately.
Details
- CWE(s)
- KEV Date Added
- 12 November 2025
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-12480 enables unauthenticated remote access to Triofox setup pages via HTTP Host header spoofing (T1190: Exploit Public-Facing Application), facilitating creation of local native admin accounts (T1136.001: Create Local Account) for subsequent payload upload and execution.