VDB
CVE-2025-30406
CVE-2025-30406
PUBLISHED
KEV
CVSS 9 CRITICAL
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, which enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: the CentreStack admin can manually delete the machineKey defined in portal\web.config.
EPSS 85.36% · 99.4th percentile
Risk Scores
CVSS 3.1
9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
85.36%
99.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| gladinet | centrestack | 0, 0 |
| Gladinet | CentreStack | 0 |
Timeline
- Apr 3, 2025 CVE Published
- Apr 3, 2025 PoC Published
- Apr 4, 2025 EPSS Score
- Apr 4, 2025 PoC Published
- Apr 4, 2025 PoC Published
- Apr 8, 2025 CISA KEV Added
- Apr 8, 2025 PoC Published
- Apr 8, 2025 PoC Published
- Apr 9, 2025 PoC Published
- Apr 9, 2025 PoC Published
- Apr 9, 2025 PoC Published
- Apr 10, 2025 PoC Published