Critical Gladinet CentreStack & Triofox Vulnerability (CVE-2025-30406) Exploited in the Wild

Understanding CVE-2025-30406

• 💡 A critical vulnerability, CVE-2025-30406, with a severity of 9.0, has been identified in Gladinet CentreStack and Triofox.
• 🚨 This vulnerability allows for remote code execution due to hardcoded cryptographic keys in the default configuration files.
• ⚠️ The flaw is particularly dangerous as it is pre-authentication, meaning no user credentials are required to exploit it.

Technical Deep Dive: Deserialization Vulnerability

• 🧠 The core of the vulnerability lies in a deserialization flaw, specifically related to view state in ASP.NET web applications.
• 🔑 Attackers can abuse this by manipulating user input, leading to the execution of arbitrary commands on the server.
• 🔒 The exploit is enabled by hardcoded cryptographic keys that are identical across all installations, effectively giving attackers the "keys to the kingdom."

Exploitation and Impact

• 🎯 Attackers can easily weaponize this vulnerability using readily available tools, often by obtaining a free trial of the software to discover the hardcoded keys.
• 📈 While not globally widespread, hundreds of vulnerable servers have been identified, and the vulnerability is actively being exploited in the wild.
• 💻 Compromised organizations have seen attackers gain persistence, deploy command and control tools like Cobalt Strike, and utilize remote management solutions.

Detection and Mitigation

• 🔍 Defenders can detect exploitation attempts by looking for specific indicators in the Windows application event log, particularly Event ID 1316, which signals a "view state verification failed."
• 🛠️ The raw payload within these logs can be decoded to reveal the encoded commands the attacker attempted to execute.
• ⚠️ While patches exist, some updates have failed to rotate the sensitive keys, making manual review and key rotation crucial for complete mitigation.