Full Report
Threat actors are exploiting a vulnerability in Gladinet’s CentreStack and Triofox products that stems from hardcoded cryptographic keys in the AES implementation.
Analysis Summary
# Vulnerability: Hardcoded Cryptographic Keys in Gladinet CentreStack and Triofox
## CVE Details
- **CVE ID:** CVE-2025-14611 (Related to ViewState deserialization CVE-2025-30406)
- **CVSS Score:** 7.1 (High)
- **CWE:** CWE-321 (Use of Hard-coded Cryptographic Key)
## Affected Systems
- **Products:** Gladinet CentreStack and Gladinet Triofox
- **Versions:** All versions prior to the December 2025 security updates.
- **Configurations:** Internet-facing servers are at the highest risk.
## Vulnerability Description
The AES implementation within Gladinet’s CentreStack and Triofox products utilizes hardcoded cryptographic keys. Because these keys are static across installations, an attacker can decrypt sensitive data or forge encrypted tokens. Specifically, this flaw allows threat actors to access and potentially manipulate the `web.config` file. In the context of a .NET application, gaining access to these configurations enables secondary attacks, such as ViewState deserialization, which leads to Remote Code Execution (RCE).
## Exploitation
- **Status:** Exploited in the wild. Reports indicate targeting by sophisticated actors, possibly including the Cl0p ransomware group.
- **Complexity:** Low (due to the static nature of the hardcoded keys).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Access to sensitive configuration files and encrypted data).
- **Integrity:** High (Ability to modify application state and execute unauthorized commands).
- **Availability:** High (Potential for ransomware deployment and system takeover).
## Remediation
### Patches
- Users should update to the latest available versions provided by Gladinet immediately. Gladinet released emergency patches in December 2025 to rotate cryptographic keys and secure the AES implementation.
### Workarounds
- **Network Filtering:** Restrict access to CentreStack/Triofox web interfaces to known/trusted IP addresses via VPN or IP allowlisting.
- **Disable Internet Exposure:** Remove vulnerable management consoles from the public internet until patched.
## Detection
- **Indicators of Compromise (IoCs):**
- **IP Addresses:** `185.196.11[.]207`, `146.70.134[.]50`
- **Malicious Files:** `C:\Users\Public\conqueror.exe`
- **SHA256 Hash:** `e9fa82d92d826c6a1c38165fe6bd610d3b80cd5d53ec65ac3fe94393be64b5a5`
- **Detection Methods:**
- Monitor for `w3wp.exe` spawning `cmd.exe` or `powershell.exe` with Base64 encoded commands.
- Inspect Windows Application Event Logs for **Event ID 1316** (associated with ViewState deserialization attempts).
- Audit for unusual `quser.exe` execution or host enumeration commands originating from the web server process.
## References
- **Vendor Blog:** hxxps[://]www.huntress[.]com/blog/active-exploitation-gladinet-centrestack-triofox-vulnerability
- **CVE Record:** hxxps[://]www.cve[.]org/CVERecord?id=CVE-2025-14611
- **Related Vulnerability:** hxxps[://]www.huntress[.]com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild