CVE-2025-12480 - Triofox Auth Bypass Enables SYSTEM-Level RCE
Category:Vulnerabilities & Exploits
Triofox file-sharing platform (v16.4.10317.56372) has a critical authentication bypass (CVE-2025-12480, CVSS 9.1) that UNC6485 actively exploited starting August 24, 2025. The attack chain is elegant: attackers manipulate HTTP host headers to "localhost", abusing the CanRunCriticalPage() function that improperly trusts the host header without verifying request origin. This grants access to protected configuration pages that create a native admin account called "Cluster Admin" through the setup process. Once authenticated, attackers leverage Triofox's antivirus feature—which lets users specify arbitrary paths for antivirus executables—to run malicious code at SYSTEM level. UNC6485 deployed centre_report.bat scripts that downloaded Zoho UEMS installers from 84.200.80[.]252, establishing remote access via Zoho Assist and AnyDesk. They also used Plink and PuTTY to create encrypted SSH tunnels to C2 over port 433, enabling persistent inbound RDP access. The vulnerability combines improper host header validation with privileged antivirus configuration—a dangerous pairing in enterprise file-sharing infrastructure. Gladinet patched this in v16.7.10368.56560. Earlier in 2025, Triofox also suffered CVE-2025-30406 (RCE via cryptographic key management) and CVE-2025-11371 (ViewState forgery leading to deserialization attacks).
CORTEX Protocol Intelligence Assessment
Business Impact: The host header manipulation is textbook HTTP smuggling tradecraft, but the real damage comes from chaining it with SYSTEM-level antivirus execution. UNC6485 essentially turned a security feature (antivirus integration) into a privilege escalation vector. The Cluster Admin account creation through setup pages is clever—it looks like legitimate administrative activity rather than exploitation. The use of legitimate remote access tools (Zoho, AnyDesk) after initial compromise helps blend into normal IT support traffic.
Strategic Intelligence Guidance
- Patch Triofox to v16.7.10368.56560+ and enforce MFA plus IP allowlisting on admin portals.
- Add upstream WAF rules to block host-header spoofing; validate X-Forwarded-Host and canonical host.
- Continuously hunt for unauthorized ‘Cluster Admin’, abnormal AV path entries, and outbound SSH tunnels.
- Segment Triofox from sensitive networks; apply JIT admin access and mandatory credential rotation.
CVEs
Vendors
Threats
Targets
Intelligence Source: CVE-2025-12480 - Triofox Auth Bypass Enables SYSTEM-Level RCE | Nov 12, 2025