CISA Warns of CentreStack’s Hard-Coded MachineKey Vulnerability Enabling RCE Attacks

Apr 09, 2025Ravie LakshmananApplication Security / Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting Gladinet CentreStack to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.

The vulnerability, tracked as CVE-2025-30406 (CVSS score: 9.0), concerns a case of a hard-coded cryptographic key that could be abused to achieve remote code execution. It has been addressed in version 16.4.10315.56368 released on April 3, 2025.

“Gladinet CentreStack contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification,” CISA said. “Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.”

Specifically, the shortcoming is rooted in the use of a hard-code “machineKey” in the IIS web.config file, which enables threat actors with knowledge of “machineKey” to serialize a payload for subsequent server-side deserialization in order to achieve remote code execution.

There are currently no details on how the vulnerability is being exploited, the identity of the threat actors exploiting it, and who may be the targets of these attacks. That said, a description of the security defect on CVE.org states that CVE-2025-30406 was exploited in the wild in March 2025, indicating its use as a zero-day.

Gladinet, in an advisory, has also acknowledged that “exploitation has been observed in the wild,” urging customers to apply the fixes as soon as possible. If immediate patching is not an option, it’s advised to rotate the machineKey value as a temporary mitigation.

Upgrade your audio game with the Logitech for Creators Blue Yeti USB Microphone. With over 33,730 ratings and an impressive 4.6 out of 5 stars, it’s no wonder this is an Amazon’s Choice product. Recently, 5K+ units were purchased in the past month.

Available in five stunning colors: Teal, Silver, Pink Dawn, Midnight Blue, and Blackout, this microphone is perfect for creators looking to produce exceptional audio. Priced at only $84.99, it’s a deal you can’t afford to miss.

Elevate your recordings with clear broadcast-quality sound and explore your creativity with enhanced effects, advanced modulation, and HD audio samples. Order now for just $84.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!