CVE-2025-30406

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.

• CWE-321
• CWE-798

• https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdfMitigation, Patch, Vendor Advisory
• https://www.centrestack.com/p/gce_latest_release.htmlRelease Notes
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30406US Government Resource

Published

Apr 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30400Use after free in Windows DWM allows an authorized attacker …7.8
• CVE-2025-30401A spoofing issue in WhatsApp for Windows prior to version 2.…6.7
• CVE-2025-30402A heap-buffer-overflow vulnerability in the loading of Execu…8.1
• CVE-2025-30403A heap-buffer-overflow vulnerability is possible in mvfst vi…8.1
• CVE-2025-30404An integer overflow vulnerability in the loading of ExecuTor…9.8
• CVE-2025-30405An integer overflow vulnerability in the loading of ExecuTor…9.8
• CVE-2025-30407Local privilege escalation due to a binary hijacking vulnera…6.3
• CVE-2025-30408Local privilege escalation due to insecure folder permission…6.7
• CVE-2025-30409Denial of service due to allocation of resources without lim…5.5
• CVE-2025-3041A vulnerability classified as critical has been found in Pro…9.8
• CVE-2025-30410Sensitive data disclosure and manipulation due to missing au…9.8
• CVE-2025-30411Sensitive data disclosure and manipulation due to improper a…10