CVE-2025-14611
ENISA EUVD: EUVD-2025-203165 ↗
Exploited in the Wild
✓ Confirmed 0-Day
Triaged: March 5, 2026
1 article
EPSS Score
Source: FIRST.org · 2026-05-24
55.09%
probability
This CVE has a 55.09% probability
of being exploited in the next 30 days.
0%
Top 98.1th percentile of all CVEs
100%
CVSS v4.0 NEW
Source: VulnerabilityLookup (CIRCL)7.1
Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable System Confidentiality Impact
Low
Vulnerable System Integrity Impact
None
Vulnerable System Availability Impact
None
Subsequent System Confidentiality Impact
High
Subsequent System Integrity Impact
High
Subsequent System Availability Impact
High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:A
Affected Products
Attack Intelligence
CWE-1390
· Weak Authentication
CWE-1391
· Use of Weak Credentials
CWE-284
· Improper Access Control
CWE-287
· Improper Authentication
CWE-330
· Use of Insufficiently Random Values
CWE-344
· Use of Invariant Value in Dynamically Changing Context
CWE-657
· Violation of Secure Design Principles
CWE-671
· Lack of Administrator Control over Security
CWE-693
· Protection Mechanism Failure
CWE-710
· Improper Adherence to Coding Standards
CWE-798
· Use of Hard-coded Credentials
Exploits & PoC
pl4tyz/CVE-2025-14611-CentreStack-and-Triofox-full-Poc-Exploit
CVE-2025-14611 CentreStack and Triofox full Poc/Exploit
0
1 repo — triés par ⭐
Rechercher sur GitHub ↗
Active Attacks Exploit Gladinet's Hard-Coded Keys for Unauthorized Access and Code Execution
TheHackerNews
Dec 11, 2025
Signal Intelligence
Confidence
85%
EPSS
55.09%
CVSS v4.0
7.1
Mentions
1
Last Seen
Dec 11, 2025
CNA Information
Analyst Note
CVE-2025-14611 is a recent 2025 vulnerability with explicit reporting of active exploitation in the wild (Huntress warning of actively exploited attacks affecting nine organizations). The CVE was published 2025-12-12 with evidence of concurrent or prior active attacks, meeting the core zero-day criteria. Absence from CISA KEV and Project Zero does not negate active exploitation documentation.
Threat Actors 1
Tick
apt_group
Information theft and espionage
🇨🇳 CN
Triage Info
Decided atMar 05, 2026