Gladinet · CentreStack
CVE-2025-30406
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
What it is
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
CISA: Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: April 29, 2025
More exploited flaws from Gladinet
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 15, 2025 | Hard Coded Cryptographic | CentreStack and Triofox | High 7.1 | 53% |
| Nov 12, 2025 | Improper Access Control | Triofox | Critical 9.1 | 96% |
| Nov 4, 2025 | Files or Directories Accessible to External Parties | CentreStack and Triofox | High 7.5 | 92% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.