Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
Gladinet · CentreStack
Gladinet CentreStack's portal relies on a hard-coded machineKey, which is a flaw in how the product handles cryptographic keys and credentials. An attacker who knows that machineKey can craft a serialized payload that the server deserializes, allowing remote code execution. The attack requires only network access to the portal, with no authentication or user interaction needed. The machineKey is defined in portal\web.config and can be removed manually by a CentreStack administrator as a mitigation.
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 1 day after disclosure. Public exploit code (Metasploit) was available the same day.
- First seen exploitedVulnCheck KEV evidence+1 day
- Added to CISA KEVEU database agrees+5 days
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 1ExecutionTA0002
This vulnerability has been exploited to give threat actors with knowledge of the CentreStack portal's machineKey the ability to craft malicious payloads for remote code execution.
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Exploitation for Client ExecutionT1203 server-side bug exploitable without user interaction; client-execution technique does not fit
Detection
1 rule for this CVE · 95 general rules for its techniquesRules for this CVE
1Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2025-30406 directly.- Suspicious Process Spawned by CentreStack Portal AppPoolhighexperimental
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Command and Scripting InterpreterT105995 general rules
- HackTool - Sliver C2 Implant Activity Patterncriticaltest
- Lazarus Group Activitycriticaltest
- REvil Kaseya Incident Malware Patternscriticaltest
- Turla Group Lateral Movementcriticaltest
- Windows Defender AMSI Trigger Detectedhighstable
- Windows Defender Threat Detectedhighstable
- Abusable DLL Potential Sideloading From Suspicious Locationhightest
- Add Insecure Download Source To Wingethightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- 44 more on OTX