CVE-2025-30406
CRITICAL KEV NUCLEIGladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE
Title source: nucleiExploitation Summary
CVE-2025-30406 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 8, 2025.
EIP tracks 5 public exploits from researchers including mchklt, W01fh4cker, threadpoolx, including a Metasploit module auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Proof-of-Concept (PoC) for CVE-2025-30406, a ViewState deserialization vulnerability in ASP.NET applications. The exploit uses ysoserial to generate a malicious payload and includes a custom HTTP server for exfiltrating command output.
Description
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
Exploits (5)
This repository contains a functional Proof-of-Concept (PoC) for CVE-2025-30406, a ViewState deserialization vulnerability in ASP.NET applications. The exploit uses ysoserial to generate a malicious payload and includes a custom HTTP server for exfiltrating command output.
This PoC exploits a deserialization vulnerability in Microsoft PowerShell Editor Services, leveraging a crafted serialized payload to achieve remote code execution. The payload includes a malicious resource dictionary with embedded XAML and C# code execution.
This is a detailed writeup explaining CVE-2025-30406, a critical insecure deserialization vulnerability in CentreStack and Triofox due to a hardcoded machineKey. It describes the attack chain, exploitation logic, and mitigation steps.
This Metasploit module exploits a path traversal vulnerability (CVE-2025-11371) in Gladinet CentreStack/Triofox, allowing unauthenticated attackers to read arbitrary files via the `/storage/t.dn` endpoint by manipulating the `s` parameter. It includes functionality to extract the machineKey from Web.config for potential follow-up attacks.
This Metasploit module exploits a ViewState deserialization vulnerability in Gladinet CentreStack/Triofox due to hardcoded machine keys, allowing remote code execution via forged ViewState payloads.
Nuclei Templates (1)
http.favicon.hash:1163764264
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H