Critical severity9.0CISA KEVNVD Advisory· Published Apr 3, 2025· Updated Jun 17, 2026
CVE-2025-30406
CVE-2025-30406
Description
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:gladinet:centrestack:*:*:*:*:*:*:*:*range: <16.4.10315.56368
- (no CPE)range: <=16.1.10296.56315
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
3- gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdfnvdMitigationPatchVendor Advisory
- www.centrestack.com/p/gce_latest_release.htmlnvdRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
0No linked articles in our index yet.