CVE-2025-12480

Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

Affected

TrioFox

CVSS v3.1 GOOGLE

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

95.75% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2025-11-12

Nuclei

critical · CWE-306

Published

2025-11-10

Updated

2026-02-26

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-12480.yaml

Security advisories

• https://cloud.google.com/blog/topics/threat-intelligence/triofox-vulnerability-cve-2025-1…
• mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0008.md
• https://access.triofox.com/releases_history
• https://www.triofox.com

References

• CVE Record
• NVD entry