Full Report
What is a CVE Numbering Authority (CNA)? Learn how CNAs assign CVE IDs, why they matter for vulnerability management, and how Huntress became one.
Analysis Summary
# Vulnerability: Hardcoded Cryptographic Keys in Gladinet CentreStack & Triofox
## CVE Details
- **CVE ID:** CVE-2025-30406
- **CVSS Score:** Critical (Exact numerical score not provided in text, but categorized as "Critical")
- **CWE:** CWE-321 (Use of Hard-coded Cryptographic Key)
## Affected Systems
- **Products:** Gladinet CentreStack and Gladinet Triofox
- **Versions:** All versions utilizing the specific AES implementation with hardcoded keys (Contact vendor for version-specific confirmation).
- **Configurations:** Systems where these products are deployed, particularly those exposed to the internet.
## Vulnerability Description
The vulnerability stems from the use of hardcoded cryptographic keys within the AES (Advanced Encryption Standard) implementation of Gladinet’s CentreStack and Triofox products. Because these keys are static and embedded in the software code, an attacker who recovers the key can decrypt sensitive information, bypass security controls, or potentially perform unauthorized actions within the application environment.
## Exploitation
- **Status:** Exploited in the wild.
- **Complexity:** Low (Hardcoded keys significantly lower the barrier for exploitation once the key is identified).
- **Attack Vector:** Network (Remote exploitation has been observed).
## Impact
- **Confidentiality:** High (Ability to decrypt protected data).
- **Integrity:** High (Potential for unauthorized modification of data or configurations).
- **Availability:** High (Potential for system compromise leading to service disruption).
## Remediation
### Patches
- Users are advised to update Gladinet CentreStack and Triofox to the latest available versions provided by the vendor to address the insecure cryptography implementation.
### Workarounds
- Ensure that CentreStack and Triofox instances are not directly internet-facing if possible.
- Implement strict IP whitelisting to limit access to known-good management IPs.
## Detection
- **Indicators of Compromise:** Huntress has noted similar TTPs (Tactics, Techniques, and Procedures) across different incidents involving this CVE; look for unauthorized access to administrative interfaces or unusual cryptographic operations.
- **Detection methods and tools:** Security scanners and EDR/MDR tools (like Huntress) are monitoring for active exploitation attempts and the presence of vulnerable software versions.
## References
- **Huntress Advisory:** hxxps[://]www[.]huntress[.]com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
- **Technical Deep Dive:** hxxps[://]www[.]huntress[.]com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild
- **CVE Program:** hxxps[://]www[.]cve[.]org/