CVE-2025-30406
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
Description
CVE-2025-30406 is a critical deserialization vulnerability in Gladinet CentreStack, an enterprise cloud file sharing and collaboration platform. The vulnerability stems from the use of a hardcoded machineKey in the CentreStack portal's web.config file, which allows an unauthenticated remote attacker who knows this key to craft serialized .NET payloads that the server deserializes and executes, achieving remote code execution. With a CVSS v3.1 score of 9.0 and an EPSS score of 87.9% at the 99th percentile, CVE-2025-30406 was actively exploited in the wild in March 2025 before being added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of April 29, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| gladinet | centrestack | < 16.4.10315.56368 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf(Mitigation, Patch, Vendor Advisory)
- https://www.centrestack.com/p/gce_latest_release.html(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30406(US Government Resource)
Weakness Type
CWE-321: Use of Hard-coded Cryptographic Key
The primary weakness behind CVE-2025-30406 is the use of a hardcoded cryptographic machineKey in the CentreStack portal configuration. This key, which should be unique per installation, was instead shared across all default deployments. Attackers who obtain this key can forge ViewState payloads that pass the server's integrity verification and are subsequently deserialized.
Learn more: CWE-321 — Use of Hard-coded Cryptographic Key
CWE-798: Use of Hard-coded Credentials
CVE-2025-30406 also falls under CWE-798, as the hardcoded machineKey effectively functions as a shared secret credential embedded in the application's default configuration. Any attacker with knowledge of this default value can bypass the cryptographic protections intended to prevent ViewState tampering.
Learn more: CWE-798 — Use of Hard-coded Credentials
Impact Analysis
CVE-2025-30406 has a CVSS v3.1 base score of 9.0 (Critical) with devastating potential impact. Although exploitation requires high attack complexity (AC:H) due to the need to know or obtain the hardcoded machineKey, no privileges (PR:N) or user interaction (UI:N) are required, and the scope is Changed (S:C), meaning the vulnerability can affect resources beyond the CentreStack application itself. Confidentiality, integrity, and availability are all rated High because successful exploitation achieves remote code execution on the CentreStack server, granting the attacker the ability to read all files managed by the platform, install persistent backdoors, exfiltrate enterprise data, and pivot to other systems on the network. Given that CentreStack is designed to manage sensitive enterprise files, the data exposure risk is exceptionally high. The EPSS score of 87.9% at the 99th percentile confirms near-certain exploitation, placing this vulnerability in the top 1% of all CVEs by exploitation probability.
Exploit Maturity
CVE-2025-30406 demonstrates very high exploit maturity with confirmed exploitation in the wild since March 2025. CISA has added it to the Known Exploited Vulnerabilities catalog with an April 29, 2025 deadline. The EPSS score of 87.9% at the 99th percentile indicates very high likelihood of exploitation. The Gladinet security advisory provides details about the hardcoded machineKey vulnerability, and the vendor's patch and mitigation documentation is publicly available. The exploitation pattern — targeting .NET deserialization through hardcoded machineKeys — is a well-understood attack technique with mature tooling (such as ysoserial.net), making weaponization straightforward for any attacker who identifies a CentreStack instance.
Remediation
-
Upgrade CentreStack to version 16.4.10315.56368 or later immediately. This version generates a unique machineKey during installation, eliminating the hardcoded key vulnerability. Follow the upgrade instructions at the CentreStack release page.
-
As an immediate workaround, manually replace the machineKey in the portal's web.config file. Generate a unique, cryptographically random machineKey and replace the default value. This can be done without upgrading the full application and immediately prevents exploitation using the known hardcoded key.
-
Conduct forensic analysis of CentreStack servers that were running vulnerable versions while internet-accessible. Search for indicators of compromise including unexpected web shells, new administrative accounts, modified configuration files, and unauthorized file access patterns. .NET deserialization attacks often leave artifacts in IIS logs and Windows event logs.
-
Restrict network access to the CentreStack portal to trusted IP ranges using firewall rules or reverse proxy configurations. If the portal must be internet-facing, deploy a web application firewall (WAF) with rules to detect serialized .NET object payloads in HTTP POST parameters.
-
Review and rotate all credentials and sensitive data accessible through the CentreStack server. Assume that any data managed by a compromised CentreStack instance may have been accessed or exfiltrated. Rotate API keys, service account passwords, and encryption keys stored on or accessible from the server.
Technical Details
CVE-2025-30406 is a deserialization-based remote code execution vulnerability in Gladinet CentreStack through version 16.1.10296.56315. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H reflects a network-accessible attack with changed scope, meaning successful exploitation impacts resources beyond the vulnerable component. The root cause is a hardcoded machineKey in the portal's web.config file. In ASP.NET applications, the machineKey is used to cryptographically sign and optionally encrypt ViewState data, which is serialized .NET object state transmitted between the client and server. When the machineKey is known (as it is in this case, since it is hardcoded and identical across all default installations), an attacker can craft a valid serialized .NET object payload, sign it with the known key, and submit it as ViewState data. The server validates the signature, finds it correct, and proceeds to deserialize the attacker-controlled payload. By using known .NET deserialization gadget chains, the attacker achieves arbitrary code execution in the context of the IIS worker process, which typically runs with elevated privileges sufficient to compromise the entire CentreStack server and potentially the underlying operating system.
Frequently Asked Questions
Is CVE-2025-30406 being actively exploited?
Yes. CVE-2025-30406 was exploited in the wild beginning in March 2025, prior to its addition to CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 87.9% at the 99th percentile places it among the most actively exploited vulnerabilities.
What products are affected by CVE-2025-30406?
Gladinet CentreStack versions through 16.1.10296.56315 are affected. The vulnerability is fixed in version 16.4.10315.56368 and later.
How do I fix CVE-2025-30406?
Upgrade to CentreStack 16.4.10315.56368 or later. As an immediate workaround, manually replace the hardcoded machineKey in portal/web.config with a unique, randomly generated value.
How severe is CVE-2025-30406?
With a CVSS score of 9.0 (Critical) and near-certain exploitation probability (EPSS 87.9%), CVE-2025-30406 is extremely severe. It enables unauthenticated remote code execution on enterprise file sharing servers, potentially exposing all managed files and enabling lateral movement.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.