Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability (CVE-2025-30406)

What is affected, what to do

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.

The vulnerability is being actively exploited; treat it as a priority. Update Gladinet CentreStack to version 16.4.10315.56368. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Gladinet CentreStack lt *..16.4.10315.56368

Fixed in

• Gladinet CentreStack 16.4.10315.56368

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every Gladinet CentreStack and Triofox instance, including cluster and worker nodes, and record the installed build. CentreStack up to and including 16.1.10296.56315 is affected.
   • Patch: Upgrade CentreStack to 16.4.10315.56368 or later. For Triofox, a patch is available from the vendor — look up the exact version in the vendor advisory.
   • Rotate the machineKey: If you can't upgrade right away, remove the hard-coded <machineKey> element from portal\web.config or replace it with uniquely generated validationKey/decryptionKey values, then run iisreset. Regenerate the key after patching as well if prior compromise cannot be ruled out.
   • Cut exposure: Put the web portal (TCP 443/80) behind VPN or an IP allowlist, or take it offline, until patching and key rotation are complete.
   • Compromise assessment: Hunt through IIS logs and EDR telemetry back to March 2025 (see detection rules). On any hit, isolate the host, capture a forensic image, and open an incident aligned with the NIS2 early-warning deadline of 24 h.
   • Rotate secrets: On confirmed or suspected compromise, rotate every secret stored on the server. This includes service accounts, AD bind accounts, cloud storage access keys and database credentials.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Host CentreStack/Triofox in a DMZ. Apply default-deny egress so the server can reach only the storage and AD targets it needs, which blocks reverse shells and second-stage downloads.
   • WAF/IPS: Alert on or block POSTs to .aspx endpoints that carry oversized __VIEWSTATE parameters. After decoding, also look for known gadget-chain markers in Base64, such as AAEAAAD///// (BinaryFormatter header) or TypeConfuseDelegate/ObjectDataProvider fragments.
   • Endpoint hardening: Use an EDR rule or AppLocker/WDAC to stop w3wp.exe from spawning cmd.exe, powershell.exe, rundll32.exe, certutil.exe or mshta.exe.
   • Least privilege: Don't run the IIS application pool as LocalSystem or with domain admin rights. Use a dedicated identity with minimal NTFS and AD permissions.
   • Configuration integrity: Put portal\web.config under file integrity monitoring. Verify that no node still carries the default machineKey, especially cloned VMs and golden images.
3. 03

   Runbook step 3

   Detection rules

   • ASP.NET events (Windows Application log): Event ID 1316 with event code 4009 ("Viewstate verification failed") indicates tampered ViewState payloads. Bursts from a single external IP are a strong signal. Example KQL: Event | where Source startswith "ASP.NET" and EventID == 1316 and RenderedDescription has "4009".
   • Process ancestry (Sysmon EID 1 / EDR): Any child process of w3wp.exe on CentreStack hosts. Sigma shape: ParentImage|endswith: '\w3wp.exe' AND Image|endswith: ['\cmd.exe','\powershell.exe','\certutil.exe','\curl.exe','\whoami.exe'].
   • IIS access logs: POSTs to portal .aspx pages that return 500 or have abnormally large request sizes, followed by unusual outbound traffic. Example SPL: index=iis cs_method=POST cs_uri_stem="*.aspx" sc_status=500 | stats count by c_ip, cs_uri_stem.
   • Persistence and staging: Sysmon EID 11 file creation by w3wp.exe in the webroot (*.aspx, *.ashx, *.dll) suggests webshells. Watch Sysmon EID 3 or Zeek conn.log for new outbound connections from the server to unfamiliar destinations.
   • Credential access: LSASS access (Sysmon EID 10) and new local accounts (Security EID 4720/4732) on the server shortly after a suspicious web request.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Gladinet Gladinet CentreStack

Weakness classes (CWE)

• CWE-321Use of Hard-coded Cryptographic Key

  Variant

  The product uses a hard-coded, unchangeable cryptographic key.

  Entry at MITRE CWE-321

References & sources

• centrestack.comp/gce_latest_release.htmlRelease notes
• gladinetsupport.s3.us-east-1.amazonaws.comGladinet advisory: Gladinet CentreStackMitigation, Patch, Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30406government-resource, US government resource
• pwn.watchpwn.watch: Gladinet CentreStack: CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerabilitypwn-watch
• gladinetsupport.s3.us-east-1.amazonaws.comGladinet advisory: Gladinet CentreStackpwn-watch
• NVD (NIST)NVD: CVE-2025-30406pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch