CVE-2025-30406
📋 TL;DR
This vulnerability in Gladinet CentreStack allows remote code execution through deserialization attacks. Threat actors who obtain the hardcoded machineKey can craft malicious payloads to execute arbitrary code on affected servers. All CentreStack deployments through version 16.1.10296.56315 are vulnerable unless patched or manually secured.
💻 Affected Systems
- Gladinet CentreStack
📦 What is this software?
Centrestack by Gladinet
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative privileges, data exfiltration, ransomware deployment, and lateral movement within the network.
Likely Case
Remote code execution leading to data theft, installation of backdoors, or cryptomining malware on vulnerable servers.
If Mitigated
Limited impact if proper network segmentation, least privilege, and monitoring are in place, though RCE still poses significant risk.
🎯 Exploit Status
Actively exploited in the wild since March 2025. Attackers need to know the machineKey value, which is hardcoded in vulnerable versions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.4.10315.56368
Vendor Advisory: https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf
Restart Required: Yes
Instructions:
1. Download CentreStack version 16.4.10315.56368 or later from official vendor site. 2. Backup current installation and configuration. 3. Run the installer to upgrade. 4. Restart CentreStack services. 5. Verify the machineKey is no longer hardcoded in portal\web.config.
🔧 Temporary Workarounds
Manual machineKey removal
windowsRemove or modify the hardcoded machineKey in web.config to prevent exploitation
Navigate to portal\web.config
Locate <machineKey> section
Delete or modify the hardcoded value
Restart IIS or CentreStack services
🧯 If You Can't Patch
- Network segmentation: Isolate CentreStack servers from internet and restrict internal access
- Implement web application firewall (WAF) rules to block deserialization attacks
🔍 How to Verify
Check if Vulnerable:
Check CentreStack version via admin portal or examine portal\web.config for hardcoded machineKey valueCheck Version:
Check CentreStack admin dashboard or examine installation directory version filesVerify Fix Applied:
Verify version is 16.4.10315.56368 or later and machineKey in web.config is not hardcoded📡 Detection & Monitoring
Log Indicators:
- Unusual deserialization errors in CentreStack logs
- Suspicious process creation from CentreStack service
- Unexpected network connections from CentreStack server
Network Indicators:
- HTTP POST requests to CentreStack portal with serialized payloads
- Outbound connections to suspicious IPs from CentreStack server
SIEM Query:
source="centrestack" AND (event_type="deserialization" OR process_name="powershell" OR cmdline="*serialize*")