Active Attacks Exploit Gladinet's Hard-Coded Keys for Unauthorized Access and Code Execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-11371 | Unauthenticated Local File Inclusion in Gladinet CentreStack and Triofox Gladinet CentreStack and Triofox, in their default installation and configuration, contain an unauthenticated local file inclusion flaw (CWE-552) that allows unintended disclosure of system files to remote attackers. The flaw requires no privileges or user interaction (CVSS 3.1: AV:N/PR:N/UI:N, 7.5 High), so any internet-facing deployment is directly reachable over the network. An attacker gains access to system files that should not be externally readable, and related reporting indicates active attacks have chained the flaw — including with Gladinet's hardcoded keys — toward unauthorized access, code execution, and deployment of remote access tools. All versions prior to and including 16.7.10368.56560 of both products are affected. Exploitation has been observed in the wild: the vulnerability was added to CISA's KEV on 2025-11-04 and carries a 92.1% EPSS probability of exploitation within 30 days. Do: Upgrade CentreStack and Triofox to a release newer than 16.7.10368.56560, and apply vendor mitigations per CISA BOD 22-01 requirements (federal agencies must mitigate or discontinue use of affected versions). Until patched, restrict internet exposure of the service and review logs for suspicious unauthenticated requests, unexpected file reads, new accounts, or signs of follow-on compromise such as remote-access tool installation. The Huntress write-up referenced in this record provides exploitation context for detection guidance; no exploit code is required to confirm patch status. | 7.5 | 92% | KEV PoC |
| moderate≈ thousands (10^3–10^4) of internet-facing CentreStack/Triofox server deployments; exact counts unknown | |
| CVE-2025-14611 | Hard-Coded AES Keys in Gladinet CentreStack and Triofox Enable Unauthenticated LFI Gladinet CentreStack and Triofox versions prior to 16.12.10420.56791 use hardcoded values for their AES cryptoscheme implementation (CWE-798), meaning affected deployments share fixed encryption keys. Because the keys are static, an unauthenticated attacker who sends a specially crafted request to an affected, publicly exposed endpoint can degrade or bypass the cryptographic protections and achieve arbitrary local file inclusion. An attacker gains unauthorized access to protected data, and the flaw can be leveraged on its own or chained with previously disclosed vulnerabilities to achieve code execution and full system compromise. Any organization running self-hosted or MSP-hosted CentreStack or Triofox gateways exposed to the internet is affected. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2025-12-15, Huntress has published public proof-of-concept details with observed attacks, and EPSS estimates a 53.3% probability of exploitation within 30 days. Do: Upgrade CentreStack and Triofox to version 16.12.10420.56791 or later per vendor instructions; per CISA KEV/BOD 22-01 guidance, apply vendor mitigations promptly or discontinue use of the product if mitigations are unavailable. Because the hardcoded cryptographic values cannot be rotated by administrators, prioritize patching internet-facing instances and review logs for unauthenticated, specially crafted requests and signs of unauthorized access. | 7.1 | 53% | KEV PoC |
| moderatelikely thousands to low tens of thousands of internet-exposed CentreStack/Triofox instances (estimate) | |
| CVE-2025-30406 | Hard-coded machineKey enables unauthenticated deserialization RCE in Gladinet CentreStack and Triofox Gladinet CentreStack (and, per CISA, the companion product Triofox) ships with a hard-coded ASP.NET machineKey in the portal's web.config, which is used to protect ViewState and similar serialized data. An attacker who knows this fixed key can craft a serialized payload and submit it to the network-facing portal, where server-side deserialization executes it, yielding unauthenticated remote code execution (CVSS 9.8, no privileges or user interaction required). Successful RCE gives attackers full control of the file-sharing server (high confidentiality, integrity and availability impact); public reporting indicates attackers have abused the flaw to gain unauthorized access and install remote access tools. Anyone running the affected CentreStack builds is exposed, with self-hosted deployments at SMBs and MSP-hosted environments the typical footprint. The flaw was exploited in the wild in March 2025, was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-08, and carries an EPSS of 94.3% (100th percentile). Do: Upgrade CentreStack to 16.4.10315.56368 or later, and apply the equivalent vendor fix for Triofox; as an interim mitigation, administrators can delete the hard-coded machineKey defined in portal\web.config so it is regenerated. Because the flaw is actively exploited, review portals for signs of compromise (unexpected accounts, unfamiliar processes or remote access tools) and, for federal agencies, follow the applicable BOD 22-01 required actions. | 9.8 | 94% | KEV |
| moderateon the order of thousands of internet-exposed instances (self-hosted file-sharing/MFT portals, largely at SMBs and MSPs); no public install counts in the… |
Full article820 words · extracted from thehackernews.com · click to collapse
Huntress is warning of a new actively exploited vulnerability in Gladinet's CentreStack and Triofox products stemming from the use of hard-coded cryptographic keys that have affected nine organizations so far.
"Threat actors can potentially abuse this as a way to access the web.config file, opening the door for deserialization and remote code execution," security researcher Bryan Masters said.
The use of hard-coded cryptographic keys could allow threat actors to decrypt or forge access tickets, enabling them to access sensitive files like web.config that can be exploited to achieve ViewState deserialization and remote code execution, the cybersecurity company added. The vulnerability has not been assigned a CVE identifier.
At its core, the issue is rooted in a function named "GenerateSecKey()" present in "GladCtrl64.dll" that's used to generate the cryptographic keys necessary to encrypt access tickets containing authorization data (i.e., Username and Password) and enable access to the file system as a user, assuming the credentials are valid.
Because the GenerateSecKey() function returns the same 100-byte text strings and these strings are used to derive the cryptographic keys, the keys never change and can be weaponized to decrypt any ticket generated by the server or even encrypt one of the attacker's choosing.
This, in turn, opens the door to a scenario where it can be exploited to access files containing valuable data, such as the web.config file, and obtain the machine key required to perform remote code execution via ViewState deserialization.
The attacks, according to Huntress, take the form of specially crafted URL requests to the "/storage/filesvr.dn" endpoint, such as below -
/storage/filesvr.dn t=vghpI7EToZUDIZDdprSubL3mTZ2:aCLI:8Zra5AOPvX4TEEXlZiueqNysfRx7Dsd3P5l6eiYyDiG8Lvm0o41m:ZDplEYEsO5ksZajiXcsumkDyUgpV5VLxL%7C372varAu
The attack efforts have been found to leave the Username and Password fields blank, causing the application to fall back to the IIS Application Pool Identity. What's more, the timestamp field in the access ticket, which refers to the creation time of the ticket, is set to 9999, effectively creating a ticket that never expires, allowing the threat actors to reuse the URL indefinitely and download the server configuration.
As of December 10, as many as nine organizations have been affected by the newly disclosed flaw. These organizations belong to a wide range of sectors, such as healthcare and technology. The attacks originate from the IP address 147.124.216[.]205 and attempt to chain together a previously disclosed flaw in the same applications (CVE-2025-11371) with the new exploit to access the machine key from the web.config file.
"Once the attacker was able to obtain the keys, they performed a viewstate deserialization attack and then attempted to retrieve the output of the execution, which failed," Huntress said.
In light of active exploitation, organizations that are using CentreStack and Triofox should update to the latest version, 16.12.10420.56791, released on December 8, 2025. Additionally, it's advised to scan logs for the presence of the string "vghpI7EToZUDIZDdprSubL3mTZ2," which is the encrypted representation of the web.config file path.
In the event indicators or compromise (IoCs) are detected, it's imperative that the machine key is rotated by following the steps below -
- On Centrestack server, go to Centrestack installation folder C:\Program Files (x86)\Gladinet Cloud Enterprise\root
- Make a backup of web.config
- Open IIS Manager
- Navigate to Sites -> Default Web Site
- In the ASP.NET section, double click Machine Key
- Click 'Generate Keys' on the right pane
- Click Apply to save it to root\web.config
- Restart IIS after repeating the same step for all worker nodes
The development makes it the third vulnerability in CentreStack and Triofox that has come under active exploitation in the wild since the start of the year, after CVE-2025-30406 and CVE-2025-11371. Huntress told The Hacker News that it's possible the activity is the work of a single threat actor.
"We can't say for certain it's the same threat actor, but there's strong circumstantial evidence," Anna Pham, senior hunt and response analyst at Huntress, said. "The threat actor is chaining all three Gladinet vulnerabilities in a single, orchestrated attack flow and attempts to use CVE-2025-11371 for output exfiltration after achieving RCE. That's a pre-built workflow suggesting familiarity with these exploits from prior use. At minimum, whoever this is has deep knowledge of Gladinet's vulnerability history."
Flaw Now Tracked as CVE-2025-14611
The hard-coded cryptographic scheme vulnerability has been assigned the CVE identifier CVE-2025-14611 (CVSS score: 7.1). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by January 5, 2026.
"Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme," CISA said. "This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication."
(The story was updated after publication on December 16, 2025, with details of the CVE.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/12/hard-coded-gladinet-keys-let-attackers.html