CVE-2025-30406: Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
Other sources
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gladinet CentreStackto a version that resolves this vulnerability.Fixed in 16.4.10315.56368 - Configuration
Manually delete the machineKey defined in portal\web.config
Gladinet CentreStack portal machineKey = deleted from portal\web.config - Compensating control
Follow applicable BOD 22-01 guidance for cloud services
- Compensating control
Discontinue use of the product if mitigations are unavailable
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30406?
CVE-2025-30406 has been classified as a critical severity vulnerability due to its potential for exploitation.
How do I fix CVE-2025-30406?
To fix CVE-2025-30406, update Gladinet CentreStack to version 16.4.10315.56368 or later.
What is the impact of CVE-2025-30406?
CVE-2025-30406 allows threat actors to exploit a deserialization vulnerability leading to unauthorized server-side code execution.
Which versions of Gladinet CentreStack are affected by CVE-2025-30406?
Gladinet CentreStack versions up to and including 16.1.10296.56315 are affected by CVE-2025-30406.
Is there a known exploit for CVE-2025-30406?
Yes, CVE-2025-30406 has been actively exploited in the wild since March 2025.