Gladinet CentreStack and Triofox Flaw Exploited for Remote Code Execution
Summary
Huntress says attackers exploited CVE-2025-30406, a hardcoded machineKey flaw in CentreStack and Triofox, compromising seven organizations. It observed PowerShell activity and lateral movement; upgrading or changing the keys mitigates the risk.
Key points
- CVE-2025-30406 involves default hardcoded machineKey values in configuration files, which can enable ASP.NET ViewState deserialization and remote code execution.
- Huntress reported exploitation affecting seven organizations; its earliest observed indicators were on April 11, 2025.
- Huntress observed attackers using encoded PowerShell to download files, including a renamed executable that Windows Defender detected as Behavior:Win32/CobaltStrike.H!sms.
- In one observed activity chain, attackers used Impacket PowerShell commands for enumeration and installed the MeshCentral remote access agent on another endpoint.
- The minimum patched versions are CentreStack 16.4.10315.56368 and Triofox 16.4.10317.56372. Earlier versions are vulnerable, according to Huntress.
- If upgrading is not possible, change the default machineKey values. Where both root and portal web.config files exist, both must be protected; Gladinet's update removes the portal entry.
- Huntress recommends checking Windows Application Event Log ViewState errors with Event ID 1316 and has prepared Sigma and Chainsaw detection rules.
Article Details
- Vulnerability Types
- Hardcoded cryptographic keys in configuration files
- ASP.NET ViewState deserialization leading to remote code execution
- Severity
- Critical (CVSS 9.0)
- Affected Versions
- Gladinet CentreStack: versions below 16.4.10315.56368
- Triofox: versions below 16.4.10317.56372
- Exploitation Status
- active
- Exploit Availability
- claimed_or_private
- Patch Status
- available
- Workarounds
- Change the machineKey values in the web.config files. If both root and portal web.config files are present, ensure neither uses the default hardcoded key; the portal machineKey entry can instead be removed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | rtb[.]mftadsrvr[.]com | Domain contacted by the attacker-installed MeshCentral agent. |
| IPV4 | 165[.]227[.]7[.]206 | Listed as an attacker IP address in the article's IOC table. |
| IPV4 | 2[.]58[.]56[.]16 | Listed as an attacker IP address and also observed in CrushFTP exploitation. |
| SHA256 | 30981d4082b58704d12a376c3cbb12fecb8a36c2bce64666315e26aef21e75c2 | Hash listed for Centre.exe, a downloaded and executed renamed Wallpaper Engine Launcher that Windows Defender removed. |
| SHA256 | 48b006cb17e75ecdb707dc40dd654f449b94abe49f97a808b35cabca1c5fabbf | Hash listed for d3d11.dll, a DLL delivered for sideloading; the IOC table labels it Cobalt Strike (?). |
MITRE ATT&CK
T1057 · Process DiscoveryAn out-of-band PowerShell connectivity check ran tasklist and sent its output in the request body.T1059.001 · PowerShellPowerShell commands were used for connectivity checks, downloading payloads, and post-exploitation activity.T1105 · Ingress Tool TransferPowerShell Invoke-WebRequest downloaded d3d11.dll and Centre.exe onto compromised hosts.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2025-30406 against internet-exposed CentreStack and Triofox web applications.T1219 · Remote Access ToolsAttackers installed the MeshCentral remote access tool MeshAgent on a host in the organization.T1574.002 · DLL Side-LoadingThe downloaded d3d11.dll was sideloaded via the renamed launcher executable.
CVE
People
Vendors
Products
Tools
ImpacketOn the second host (that was running the Huntress agent), we observed default Impacket PowerShell commands were run to perform various enumeration commands, install the MeshCentral remote access tool MeshAgent, andMeshCentralThreat actors have also been observed performing lateral movement and performing installation of remote access tooling, namely MeshCentral.