CVE-2026-8364

Executive Summary

CVE-2026-8364 is a critical, unauthenticated remote access vulnerability in Gladinet Triofox Cloud Server Agent Access Service. The service, GladServerAgentService.exe, listens on TCP port 7878 and processes HTTP requests without any authentication checks. An attacker can send crafted HTTP messages to paths such as /resources, /status, /sysinfo, /woshome, /Settings, /schedule, or /DavCache to potentially read sensitive files, modify configurations, or execute arbitrary commands. With a CVSS score of 9.8, this vulnerability poses a severe risk to confidentiality, integrity, and availability. No patch is currently available, and no public proof-of-concept exploit has been released.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – full system read access possible.
• Integrity Impact: High (I:H) – full system write access possible.
• Availability Impact: High (A:H) – potential for denial of service or full system compromise.

Threat Level: Critical. Immediate action is required. The lack of authentication on critical endpoints allows a remote, unauthenticated attacker to fully compromise the Triofox Cloud Server Agent.

Deep Dive & Mechanics

The vulnerability resides in the GladServerAgentService.exe process, which listens on TCP port 7878. The service exposes several HTTP endpoints without any authentication or authorization checks:

• /resources – likely serves static or dynamic resources.
• /status – may expose system status and configuration.
• /sysinfo – likely exposes detailed system information.
• /woshome – unknown, but likely a misconfigured endpoint.
• /Settings – may allow reading or modifying application settings.
• /schedule – could expose or manipulate scheduled tasks.
• /DavCache – may expose cached WebDAV data.

An attacker can send HTTP GET or POST requests to these endpoints to:

• Read sensitive files (e.g., configuration files, credentials, logs).
• Modify system settings (e.g., change user permissions, disable security features).
• Execute arbitrary commands if the service interprets input as commands (e.g., via /Settings or /schedule).

The root cause is a Missing Authentication for Critical Function (CWE-306). The service does not validate the identity of the requester before processing requests to these sensitive endpoints.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a secure implementation would require:

• Authentication (e.g., API key, token, or session) for all endpoints.
• Input validation and sanitization.
• Principle of least privilege for the service account.

Vulnerable Code (Conceptual):

# Example of vulnerable HTTP handler
def handle_request(path):
    if path.startswith("/Settings"):
        # No authentication check
        return read_or_modify_settings()
    elif path.startswith("/sysinfo"):
        return get_system_info()

Patched Code (Conceptual):

def handle_request(path, auth_token):
    if not authenticate(auth_token):
        return 401 Unauthorized
    if path.startswith("/Settings"):
        return read_or_modify_settings()
    elif path.startswith("/sysinfo"):
        return get_system_info()

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Gladinet Triofox Cloud Server Agent on a Windows VM.
2. Ensure the service is running and listening on port 7878.
3. Use a separate attacker machine (Kali Linux) to interact with the service.

Exploitation Steps:

1. Reconnaissance: Scan for open port 7878 using Nmap:

   nmap -p 7878 <target_ip>
   

2. Enumerate Endpoints: Use curl to probe endpoints:

   curl http://<target_ip>:7878/status
   curl http://<target_ip>:7878/sysinfo
   curl http://<target_ip>:7878/Settings
   

3. Exploit: If an endpoint allows command execution or file read, craft a request:

   # Example: Read a configuration file
   curl http://<target_ip>:7878/resources/../../config.ini
   # Example: Modify settings
   curl -X POST -d "new_admin_password=evilpass" http://<target_ip>:7878/Settings
   

Note: No public exploit code is available. The above is a generic approach based on the vulnerability description.

Blue Team

Detection & Response:

1. Monitor Network Traffic: Look for HTTP requests to port 7878 from unexpected sources.
2. Log Analysis: Check Windows Event Logs for GladServerAgentService.exe activity.
3. Honeypot: Deploy a decoy service on port 7878 to detect scanning.
4. Block Access: Use firewall rules to restrict port 7878 to trusted IPs only.
5. Disable Service: If not needed, stop and disable the service.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Inbound connections to TCP port 7878 from external IPs.
  • HTTP requests to paths: /resources, /status, /sysinfo, /woshome, /Settings, /schedule, /DavCache.
  • Unusual HTTP methods (e.g., POST to /Settings).
• File IOCs:
  • Unexpected modifications to configuration files in the Triofox installation directory.
  • New files in the DavCache directory.
• Process IOCs:
  • GladServerAgentService.exe spawning child processes (e.g., cmd.exe, powershell.exe).
  • High CPU or memory usage by GladServerAgentService.exe.

Detection Engineering

YARA Rule

rule CVE_2026_8364_Gladinet_Triofox {
    meta:
        description = "Detects exploitation attempts against CVE-2026-8364"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-8364"
    strings:
        $s1 = "/resources" ascii wide nocase
        $s2 = "/status" ascii wide nocase
        $s3 = "/sysinfo" ascii wide nocase
        $s4 = "/woshome" ascii wide nocase
        $s5 = "/Settings" ascii wide nocase
        $s6 = "/schedule" ascii wide nocase
        $s7 = "/DavCache" ascii wide nocase
        $http_get = "GET" ascii wide
        $http_post = "POST" ascii wide
    condition:
        any of ($s*) and any of ($http_get, $http_post)
}

Sigma Rule

title: CVE-2026-8364 Gladinet Triofox Unauthenticated Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to sensitive endpoints on port 7878
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 7878
        DestinationPath|contains:
            - '/resources'
            - '/status'
            - '/sysinfo'
            - '/woshome'
            - '/Settings'
            - '/schedule'
            - '/DavCache'
    condition: selection
falsepositives:
    - Legitimate administrative access from trusted IPs
level: critical

Suricata Rule

alert tcp any any -> any 7878 (msg:"CVE-2026-8364 Gladinet Triofox Unauthenticated Access"; flow:to_server,established; content:"GET"; http_method; content:"/resources"; http_uri; sid:1000001; rev:1;)
alert tcp any any -> any 7878 (msg:"CVE-2026-8364 Gladinet Triofox Unauthenticated Access"; flow:to_server,established; content:"POST"; http_method; content:"/Settings"; http_uri; sid:1000002; rev:1;)
alert tcp any any -> any 7878 (msg:"CVE-2026-8364 Gladinet Triofox Unauthenticated Access"; flow:to_server,established; content:"/sysinfo"; http_uri; sid:1000003; rev:1;)
alert tcp any any -> any 7878 (msg:"CVE-2026-8364 Gladinet Triofox Unauthenticated Access"; flow:to_server,established; content:"/status"; http_uri; sid:1000004; rev:1;)
alert tcp any any -> any 7878 (msg:"CVE-2026-8364 Gladinet Triofox Unauthenticated Access"; flow:to_server,established; content:"/woshome"; http_uri; sid:1000005; rev:1;)
alert tcp any any -> any 7878 (msg:"CVE-2026-8364 Gladinet Triofox Unauthenticated Access"; flow:to_server,established; content:"/schedule"; http_uri; sid:1000006; rev:1;)
alert tcp any any -> any 7878 (msg:"CVE-2026-8364 Gladinet Triofox Unauthenticated Access"; flow:to_server,established; content:"/DavCache"; http_uri; sid:1000007; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Service: If the Triofox Cloud Server Agent is not required, stop and disable GladServerAgentService.exe.
2. Firewall Rules: Block inbound traffic to TCP port 7878 from untrusted networks. Use a whitelist of trusted IPs.
3. Network Segmentation: Place the affected server in a segmented network with strict access controls.

Long-Term Fix:

• Vendor Patch: Monitor Gladinet for an official patch. Apply it immediately when available.
• Workaround: If the service must remain active, implement a reverse proxy (e.g., Nginx) that enforces authentication before forwarding requests to port 7878.
• Upgrade: Consider migrating to a supported alternative if Gladinet does not provide a timely fix.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.