Full Report
Huntress has observed in the wild exploitation against CVE-2025-30406, a weakness due to hardcoded cryptographic keys.
Analysis Summary
# Vulnerability: Gladinet CentreStack & Triofox Hardcoded Cryptographic Keys
## CVE Details
- **CVE ID:** CVE-2025-30406
- **CVSS Score:** 9.0 (Critical)
- **CWE:** CWE-321 (Use of Hard-coded Cryptographic Key)
## Affected Systems
- **Products:** Gladinet CentreStack and Gladinet Triofox
- **Versions:**
- CentreStack: Versions prior to the fix (specifically noted in CISA KEV).
- Triofox: Up to and including version 16.4.10317.56372.
- **Configurations:** Systems exposed to the public internet running these ASPX applications with default `web.config` settings.
## Vulnerability Description
The vulnerability arises from the use of hardcoded cryptographic keys (`machineKey`) within the application's configuration files. Specifically, these keys are located in `web.config` files found in the root directory and the `/portal/` sub-application directory.
Because the keys are static and known, attackers can abuse the **ASPX ViewState** mechanism. By using the hardcoded keys to sign and encrypt a malicious payload, an attacker can trigger ViewState deserialization, leading to unauthorized Remote Code Execution (RCE) in the context of the IIS worker process.
## Exploitation
- **Status:** Exploited in the wild (Included in CISA’s Known Exploited Vulnerabilities catalog).
- **Complexity:** Low (No prerequisites other than knowledge of the default keys).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to the server and hosted data).
- **Integrity:** High (Ability to modify application state and files).
- **Availability:** High (Potential for system takeover or service disruption).
## Remediation
### Patches
- **Official Updates:** Apply the latest security patches provided by Gladinet for CentreStack and Triofox immediately.
- **Configuration Cleanup:** Ensure that the `machineKey` entry is unique. Official patches typically update the root `web.config` and **remove** the `machineKey` entry from the `portal\web.config` to prevent inheritance of insecure defaults.
### Workarounds
- **Manual Key Rotation:** Manually generate and replace the hardcoded `machineKey` values in all `web.config` files with unique, cryptographically strong keys.
- **Restrict Access:** Remove vulnerable instances from the public internet or restrict access via VPN/IP whitelisting until patched.
## Detection
- **Indicators of Compromise (IoC):**
- Suspicious outbound connections originating from the IIS worker process (`w3wp.exe`).
- Unusual child processes spawned by `w3wp.exe` (e.g., `powershell.exe`, `cmd.exe`).
- **Detection Methods:**
- Audit `web.config` files located at `C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config` and `...\portal\web.config` for default Gladinet machine keys.
- Monitor web server logs for irregular POST requests to ASPX pages containing large or anomalous ViewState data.
## References
- **Huntress Blog:** hxxps[://]www[.]huntress[.]com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **NIST NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2025-30406