CVE-2026-8359

Vulnerability

When processing a request with a URL path starting with /status or /sysinfo, the WOSHttpStatusModule.dll is expected to be loaded to handle such URL patterns. The WOSBin_LoadHttpModule function in that DLL would be called to set up a module object. However, WOSHttpStatusModule.dll is not present in the installation. As a result, the function pointer to WOSBin_LoadHttpModule remains NULL, leading to a call to a function at address 0 — a null-pointer dereference. This affects Gladinet Triofox Server Agent version 17.1.10488.57063 as reported in [1].

Exploitation

An unauthenticated remote attacker can send an HTTP request to the server agent listening on TCP port 7878 with a URL path starting with /status or /sysinfo. No authentication or user interaction is required. The crash occurs immediately upon processing the request, as the code tries to call a null function pointer [1].

Impact

Successful exploitation causes a null-pointer dereference crash, resulting in denial of service of the Triofox Server Agent service. No additional code execution or data compromise is achieved through this specific vulnerability [1].

Mitigation

The vulnerability is documented in the referenced research [1]. At the time of publication, no patch or fixed version has been announced by Gladinet. Users should monitor vendor advisories for an update. As a workaround, if possible, restrict network access to TCP port 7878 to trusted hosts only.