{"id":"CVE-2025-30406","aliases":["EUVD-2025-9671","GHSA-hgp9-3v5v-223j"],"status":"published","title":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization...","description":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\web.config.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.94728,"percentile":0.99859,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-321","CWE-798"],"published":"2025-04-03T00:00:00Z","modified":"2026-06-17T09:08:40Z","kev":{"date_added":"2025-04-08","due_date":"2025-04-29","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-04-08"},{"source":"kev","since":"2025-04-08"}],"exploits":[{"source":"metasploit","id":"exploit/windows/http/gladinet_viewstate_deserialization_cve_2025_30406","title":"Gladinet CentreStack/Triofox ASP.NET ViewState Deserialization","type":"exploit","platform":"Windows","date":"2025-04-03","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/gladinet_viewstate_deserialization_cve_2025_30406"},{"source":"pocgithub","id":"W01fh4cker/CVE-2025-30406","title":"W01fh4cker/CVE-2025-30406","date":"2025-04-24","url":"https://github.com/W01fh4cker/CVE-2025-30406"},{"source":"pocgithub","id":"mchklt/CVE-2025-30406","title":"mchklt/CVE-2025-30406","date":"2025-07-31","url":"https://github.com/mchklt/CVE-2025-30406"},{"source":"metasploit","id":"auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371","title":"Gladinet CentreStack/Triofox Path Traversal","type":"auxiliary","date":"2025-04-03","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371"},{"source":"nuclei","id":"CVE-2025-30406","title":"Gladinet CentreStack \u003c 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30406.yaml"}],"products":[{"vendor":"gladinet","product":"centrestack"}],"references":[{"url":"https://www.centrestack.com/p/gce_latest_release.html","tags":["Release Notes"]},{"url":"https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30406","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30406"},{"url":"https://github.com/advisories/GHSA-hgp9-3v5v-223j"}],"sources":{"cve":[{"id":"CVE-2025-30406","description":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\web.config.","status":"published","published":"2025-04-03T00:00:00Z","modified":"2025-10-21T22:55:22.155Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-321"],"updated_at":"2026-11-02T14:32:35.099955Z"}],"euvd":[{"id":"EUVD-2025-9671","description":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\web.config.","status":"published","published":"2025-04-03T00:00:00Z","modified":"2025-10-21T22:55:22Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2025-04-08","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-hgp9-3v5v-223j","title":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization...","description":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, which enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: the CentreStack admin can manually delete the machineKey defined in portal\\web.config.","status":"published","published":"2025-04-03T21:32:59Z","modified":"2025-10-22T00:33:17Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-321","CWE-798"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2025-30406","title":"Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability","description":"Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.","cwes":["CWE-321"],"kev":{"date_added":"2025-04-08","due_date":"2025-04-29","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-30406","description":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\web.config.","status":"published","published":"2025-04-03T20:15:24.987Z","modified":"2026-06-17T09:08:40.1Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-321","CWE-798"],"updated_at":"2026-11-02T14:10:58.094557Z"}]}}