Actively exploited · Published Apr 3, 2025 · Assigned by mitre
CVE-2025-30406
Critical 9.0 Exploited
In plain English
A critical-severity security flaw in CentreStack from Gladinet. Attackers are actively exploiting it in the wild (listed by CISA on April 8, 2025). The chance it is exploited in the next 30 days is estimated at 94.3% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Apr 29, 2025.
Official description
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gladinet | CentreStack | 0 – before 16.4.10315.56368 |
Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H