Actively exploited in the wild
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
Gladinet - CentreStack · Listed in the CISA KEV since 2025-04-08. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-30406
CriticalCVSS 9.0KEVSummary
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution.
Risk Assessment
An attacker who knows the machineKey can execute arbitrary code on the server, potentially leading to full system and data compromise.
Recommendation
Upgrade CentreStack to version 16.4.10315.56368 or later, and manually delete the machineKey from portal\web.config if possible.
Other vulnerabilities in Gladinet CentreStack
Original NVD description (English source)
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.