Vulnerability record · CVE-2025-30406 · published 3 April 2025
CVE-2025-30406: Gladinet CentreStack hardcoded machineKey deserialization RCE
Gladinet · Centrestack
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) uses a hardcoded machineKey in the portal's web.config, allowing deserialization of attacker-supplied data. Anyone who knows that key can craft a payload that deserializes server-side and executes code. It was exploited in the wild in March 2025 and is in CISA's KEV catalog.
Description
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, confirmed in-the-wild exploitation, KEV listing and very high EPSS make this an urgent patch.
What it is
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) uses a hardcoded machineKey in the portal's web.config, allowing deserialization of attacker-supplied data. Anyone who knows that key can craft a payload that deserializes server-side and executes code. It was exploited in the wild in March 2025 and is in CISA's KEV catalog.
Impact
An unauthenticated remote attacker gains code execution on the CentreStack server, giving full control of the host and any data or credentials it holds.
Attack surface
Reachable over the network through the CentreStack portal; the CVSS vector shows no privileges or user interaction required. The only barrier is knowledge of the hardcoded machineKey.
Exploitation
Listed in CISA KEV (added 2025-04-08) with confirmed in-the-wild exploitation in March 2025, and EPSS 30-day probability is about 0.94. No ransomware campaign use is documented in this record.
What to do
- Upgrade to CentreStack 16.4.10315.56368 or later.
- If immediate patching is not possible, manually delete the machineKey defined in portal\web.config as the vendor notes.
- Restrict network access to the CentreStack portal to trusted sources until patched.
- Rotate any secrets or credentials that may have been exposed on affected hosts.
- Follow CISA BOD 22-01 guidance or discontinue use if mitigations cannot be applied.
Detection
- Monitor CentreStack portal logs for unexpected deserialization errors or anomalous POST requests.
- Hunt for suspicious child processes spawned by the CentreStack web server (w3wp.exe or equivalent).
- Alert on outbound connections from the CentreStack host to unfamiliar addresses.
- Check portal\web.config for the presence of the hardcoded machineKey.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-30406 to the Known Exploited Vulnerabilities catalog on 8 April 2025 as "Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 29 April 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf | MitigationPatchVendor Advisory |
| https://www.centrestack.com/p/gce_latest_release.html | Release Notes |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30406 | US Government Resource |
Track CVE-2025-30406 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-30406), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
