CVE-2025-30406
KEVGladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability
View CVE record →- Vendor / Project
- Gladinet
- Product
- CentreStack
- Date added
- Apr 8, 2025
- Due date
- Apr 29, 2025
- Known ransomware use
- Unknown
- CWEs
- CWE-321
Description
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.