RCE flaw in MSP-friendly file sharing platform exploited by attackers (CVE-2025-30406)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-30406 | Hard-coded machineKey enables unauthenticated deserialization RCE in Gladinet CentreStack and Triofox Gladinet CentreStack (and, per CISA, the companion product Triofox) ships with a hard-coded ASP.NET machineKey in the portal's web.config, which is used to protect ViewState and similar serialized data. An attacker who knows this fixed key can craft a serialized payload and submit it to the network-facing portal, where server-side deserialization executes it, yielding unauthenticated remote code execution (CVSS 9.8, no privileges or user interaction required). Successful RCE gives attackers full control of the file-sharing server (high confidentiality, integrity and availability impact); public reporting indicates attackers have abused the flaw to gain unauthorized access and install remote access tools. Anyone running the affected CentreStack builds is exposed, with self-hosted deployments at SMBs and MSP-hosted environments the typical footprint. The flaw was exploited in the wild in March 2025, was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-08, and carries an EPSS of 94.3% (100th percentile). Do: Upgrade CentreStack to 16.4.10315.56368 or later, and apply the equivalent vendor fix for Triofox; as an interim mitigation, administrators can delete the hard-coded machineKey defined in portal\web.config so it is regenerated. Because the flaw is actively exploited, review portals for signs of compromise (unexpected accounts, unfamiliar processes or remote access tools) and, for federal agencies, follow the applicable BOD 22-01 required actions. | 9.8 | 94% | KEV |
| moderateon the order of thousands of internet-exposed instances (self-hosted file-sharing/MFT portals, largely at SMBs and MSPs); no public install counts in the… | |
| CVE-2025-31161 | Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161) CrushFTP contains an authentication bypass (CWE-305) in its handling of the HTTP authorization header, allowing crafted header values to grant access without valid credentials. A remote, unauthenticated attacker who can reach the server's HTTP/HTTPS interface can use this flaw to authenticate as any known or guessable account, such as the built-in crushadmin user. With administrative access, the attacker can typically achieve full compromise of the file-transfer server, including access to hosted files and user accounts. Any organization running CrushFTP is affected, with internet-exposed instances at the highest risk. The flaw is being actively exploited: it was added to CISA's KEV on 2025-04-07 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Upgrade to the vendor's fixed releases (10.8.0 for the 10.x line and 11.3.1 for the 11.x line, per vendor advisories); federal agencies must follow BOD 22-01 timelines or discontinue use if mitigations are unavailable. Until patched, restrict network access to the CrushFTP HTTP/HTTPS interface and audit authentication logs for unexpected logins to privileged accounts such as crushadmin. Given confirmed ransomware use, treat internet-exposed instances as actively targeted and verify there are no signs of prior compromise after patching. | 9.8 | 100% | KEV ransomware PoC ×4 |
| moderate≈5,000–10,000 internet-exposed CrushFTP servers (public scan counts), with additional uncounted internal enterprise deployments |
Full article504 words · extracted from helpnetsecurity.com · click to collapse
A critical RCE vulnerability (CVE-2025-30406) affecting the Gladinet CentreStack file-sharing/remote access platform has been added to CISA’s Known Exploited Vulnerabilities catalog on Tuesday.
According to the vulnerability’s entry in NIST’s National Vulnerability Database, the flaw has been leveraged in attacks since March 2025.
About CVE-2025-30406
CentreStack is a platform that allows managed service providers (MSPs) to offer cloud-like file services to their customers: file sharing, backup, collaboration, and remote access.
CVE-2025-30406 is a deserialization vulnerability caused by the CentreStack portal’s hardcoded machineKey use.
“The application uses a hardcoded or improperly protected machineKey in the IIS
web.config file, which is responsible for securing ASP.NET ViewState data,” Gladinet explained in an advisory published last week.
“If an attacker obtains or predicts the machineKey, they can forge ViewState payloads that pass integrity checks. In some scenarios, this can result in ViewState deserialization attacks, potentially leading to remote code execution (RCE) on the web server.”
What to do?
The vulnerability affects CentreStack versions up to and including v16.1.10296.56315, and has been fixed in version 16.4.10315.56368, released on April 3, 2025. This latest version automatically generates and applies a new, unique machine key during installation to enhance system security.
Customers who cannot update their installations immediately are advised to manually generate and apply a new machineKey.
But CVE-2025-30406 also affects Triofox, Gladinet’s enterprise-focused, single-tenant file sharing and remote access platform. And, according to the company’s security advisory related to the vulnerability in solution, “exploitation has been observed in the wild” – though CISA does not mention that in the KEV catalog.
Gladinet has released a security update (v16.4.10317.56372) for Triofox, as well, and the mitigation advice is the same as for CentreStack deployments: rotate the machineKey.
Vulnerabilities (often zero-days) in enterprise-grade file transfer/sharing solutions are often exploited by attackers: flaws in Progress Software’s MOVEit solution, Cleo‘s various file transfer software, Fortra’s GoAnywhere and, most recently, CrushFTP have been leveraged by attackers in the past two years.
We’ve reached out to Gladinet for more details about the attacks, but have yet to hear back from them. We’ll update this article when we know more.
UPDATE (April 14, 2025, 12:25 p.m. ET):
Huntress researchers say that they have seen seven different organizations compromised via CVE-2025-30406.
After a successful exploitation, the threat actors try to download a malicious executable file, install a remote access tool (MeshCentral), and perform lateral movement.
Huntress says that there are similarities in tradecraft between these attacks and a cluster of activity exploiting the recent CrushFTP authentication bypass vulnerability (CVE-2025-31161).
They have shared a PowerShell script admins can use to check whether their server running Gladinet CentreStack or Triofox is vulnerable, and another one to generate a new decryption key and validation key in the server’s web.config file, to streamline the process of changing the machineKey.
They have also shared indicators of compromise defenders can check to ascertain whether their organizations have been hit.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/04/09/rce-gladinet-centrestack-file-sharing-exploited-cve-2025-30406/