Description
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Gladinet | CentreStack | < 16.4.10315.56368 | 16.4.10315.56368 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Gladinet CentreStack/Triofox ASP.NET ViewState Deserialization
exploit/windows/http/gladinet_viewstate_deserialization_cve_2025_30406
GitHub 2 repositories
-
mchklt/CVE-2025-30406 ★ 91 · Jul 31, 2025
CVE-2025-30406 ViewState Exploit PoC
-
W01fh4cker/CVE-2025-30406 ★ 12 · Apr 24, 2025
Exploit for CVE-2025-30406
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE http/cves/2025/CVE-2025-30406.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- NCSC-2025-0121 Kwetsbaarheid verholpen in Gladinet CentreStack NCSC-NL (Netherlands) · Apr 10, 2025