CVE-2025-30406criticalunder attackCWE-321

CVE-2025-30406: critical vulnerability in Gladinet CentreStack

Published · Updated

Follow this CVE+ Monitor CentreStack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9epss 94%
from disclosure to weapon21 days
Published on NVDApr 3
1st PoC+21d
metasploitApr 3
CISA KEV+5d
Action required by CISAfederal deadline: 2025-04-29

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Gladinet CentreStack uses a fixed, publicly known encryption key that allows attackers to craft malicious data files. When the server processes these files, it executes arbitrary code, giving attackers complete control of the system.

Technical detail

CentreStack versions up to 16.1.10296.56315 employ a hardcoded machineKey for deserialization in the portal, enabling unauthenticated remote code execution. An attacker with knowledge of the machineKey can serialize a malicious payload that achieves RCE upon server-side deserialization without authentication. Mitigation includes upgrading to 16.4.10315.56368 or manually removing the machineKey from portal\web.config.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Gladinet · CentreStack
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Gladinet CentreStack

In the same product, most dangerous first.

CVE-2026-54368HIGHCentreStack < 17.4 SQL Injection via x-glad-filter HeaderEPSS 0.7%CVE-2026-54363CRITICALCentreStack < 17.5 Hardcoded Key Token Forgery RCEEPSS 0.7%CVE-2026-54366HIGHCentreStack < 17.4 XXE via SharePoint Storage ConfigurationEPSS 0.5%CVE-2026-54364MEDIUMCentreStack < 17.4 Session Injection via SelectProvider.aspxEPSS 0.4%CVE-2026-54365HIGHCentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dllEPSS 0.4%CVE-2026-54367HIGHCentreStack < 17.2 Unauthenticated API Authorization BypassEPSS 0.3%