CRITICAL

CVE-2025-30406

Gladinet Centrestack 2025-04-03 CVSS v3.1

CVSS

9.8

KEV

Description

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.

Summary dbcve.org

Gladinet CentreStack contains a deserialization vulnerability stemming from a hardcoded machineKey in the portal's web.config file. Attackers who obtain this machineKey can craft malicious serialized payloads that, when deserialized by the server, enable remote code execution. This vulnerability was actively exploited in the wild in March 2025.

Mitigation

Upgrade CentreStack to version 16.4.10315.56368 or later, or immediately remove the hardcoded machineKey entry from portal\web.config as a temporary workaround.

Patch Commit

Weakness (CWE)

CWE-321

CWE-798 Hard-coded Credentials

EPSS Score

94.34%

Probability of exploitation in next 30 days

99.8th percentile

References

https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf Mitigation, Patch, Vendor Advisory https://www.centrestack.com/p/gce_latest_release.html Release Notes https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30406 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE