CVE-2025-30406

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-321CWE-798

Affected software

VendorProductVersions
GladinetCentreStack< 16.4.10315.56368

References

Timeline

Published
Apr 3, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Apr 8, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-304076.3Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (CVE-2025-304086.7Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (WindoCVE-2025-304095.5Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (WinCVE-2025-30419.8A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of theCVE-2025-304109.8Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud ACVE-2025-3041110.0Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiCVE-2025-3041210.0Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (LiCVE-2025-304134.4Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud AgentCVE-2025-304147.1Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) CVE-2025-304157.5Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (LinuxCVE-2025-3041610.0Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (LinuCVE-2025-304177.8There is a memory corruption vulnerability due to an out of bounds write in Library!DecodeBase64() when using the SymbolEditor in NI Circuit
CVE-2025-30406: Critical severity, CVSS 9.8 | Vulnix