CVE-2025-30406

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 94.34%
EPSS Percentile: 99.85%
CISA KEV: YES — Known Exploited Vulnerability

Description

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 04-Apr-2025 03:15
Last Modified: 17-Jun-2026 16:08
EPSS Date: 2026-10-16
CWE: CWE-321, CWE-798

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2025-04-08
Remediation Due: 2025-04-29
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf ; https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2025-triofox.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2025-30406

Affected Products / Versions

gladinet / centrestack
Version / affected range: * · before (exclusive) 16.4.10315.56368
cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*

References

Last enrichment sync: 17-Oct-2026 12:52
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (5)

malicious IP address that began the attack leveraging the ViewState deserialization vulnerability by CVE-2025-30406. Gladinet CentreStack and Triofox Flaw Exploited to Access Configuration Files
In April 2025, Huntress published its findings on the exploitation of CVE-2025-30406, a critical-severity flaw in Gladinet CentreStack and Triofox products. Gladinet CentreStack and Triofox Flaw Exploited to Steal Machine Keys
In April, threat actors targeted ViewState while exploiting critical flaws in the Gladinet CentreStack and Triofox flaw (CVE-2025-30406). ClickFix Variants, Deepfake Scams and ViewState Attacks Feature in 2025 Threat Trends
CVE-2025-31161 Auth Bypass and Post-Exploitation blog was published, and on 14 April 2025, the CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited in the Wild blog was published. Huntress Finds Attackers Reused Tactics in CrushFTP and CentreStack Intrusions
CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild Gladinet CentreStack and Triofox Flaw Exploited for Remote Code Execution

CVE (4)

Malware (4)

People (4)

MITRE ATT&CK (9)

Vendors (6)

Products (9)

Tools (4)

Industries (3)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.