CVE-2025-30406
KEVCRITICAL 9.8EPSS 94.3%
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 9.0 CRITICAL
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS
- 94.25% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2025-04-08
- Nuclei
- critical · CWE-502
- Published
- 2025-04-03
- Updated
- 2025-10-21
Proof-of-concept exploits (3)
- W01fh4cker/CVE-2025-3040612★ · 2025-04-24
- mchklt/CVE-2025-3040690★ · 2025-07-31
- pl4tyz/CVE-2025-14611-CentreStack-and-Triofox-full-Poc-Exploit