Gladinet CentreStack and Triofox Flaw Exploited to Access Configuration Files
Summary
Huntress says attackers exploited hardcoded cryptographic keys in Gladinet CentreStack and Triofox to access web.config and attempt ViewState deserialization. It recommends updating to version 16.12.10420.56791; a link to cl0p remains unconfirmed.
Key points
- Huntress traced the flaw to hardcoded AES keys and an initialization vector used to decrypt CentreStack and Triofox access tickets.
- Attackers could use crafted tickets to retrieve web.config, which contains machine keys that can enable ViewState deserialization and potential remote code execution.
- Huntress reported nine affected organizations as of December 10 and two additional suspected exploitation incidents on December 15.
- In the December 15 incidents, attackers used PowerShell to download and run conqueror.exe from 185.196.11[.]207; Huntress could not further analyze the missing payload.
- Huntress observed host enumeration and identified 146.70.134[.]50 in Windows event logs as an IP involved in an attack exploiting the ViewState vulnerability CVE-2025-30406.
- Reports that cl0p was targeting internet-facing Gladinet servers were not independently confirmed by Huntress.
- Gladinet's latest version cited is 16.12.10420.56791; Huntress recommends updating and rotating the machine key.
Article Details
- Vulnerability Types
- Insecure cryptography due to hardcoded AES keys and initialization vector
- ViewState deserialization leading to remote code execution
- Severity
- CVSS 7.1 out of 10 for CVE-2025-14611
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Update CentreStack and Triofox to version 16.12.10420.56791.
- Rotate the machineKey.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 146[.]70[.]134[.]50 | Identified in Windows event logs as the malicious IP address that began an attack exploiting the ViewState deserialization vulnerability. |
| IPV4 | 147[.]124[.]216[.]205 | Source IP address used in observed attacks to obtain web.config and exploit the vulnerability. |
| IPV4 | 185[.]196[.]11[.]207 | Host serving the downloaded conqueror.exe payload over port 8000. |
| SHA256 | e9fa82d92d826c6a1c38165fe6bd610d3b80cd5d53ec65ac3fe94393be64b5a5 | SHA-256 hash identified for the downloaded conqueror.exe payload. |
MITRE ATT&CK
T1046 · Network Service DiscoveryThe article reports standard host enumeration commands executed through conqueror.exe.T1059.001 · PowerShellPowerShell commands were executed to download conqueror.exe and issue a curl request.T1059.003 · Windows Command ShellA cmd.exe command launched PowerShell to download the payload.T1105 · Ingress Tool TransferThe attacker downloaded conqueror.exe from 185.196.11.207:8000.