Use of hard-coded cryptographic key in CentreStack - CVE-2025-30406

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of a hard-coded cryptographic key when encrypting ViewState data. A remote non-authenticated attacker can predict the machineKey in use and forge ViewState payloads that pass integrity checks.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on the system with privileges of the Microsoft IIS webserver account. 

Note, the vulnerability is being actively exploited in the wild.

Affected software

How to mitigate CVE-2025-30406

Links to Public Exploits and PoC-codes

• Exploit #11984 - CVE-2025-30406 (? Demonstrate a ViewState deserialization exploit for CVE-2025-30406 in ASP.NET, enabling remote code execution with a Proof-of-Concept script.) (September 24, 2025)
• Exploit #11836 - CVE-2025-30406 (August 8, 2025)
• Exploit #11416 - Gladinet CentreStack/Triofox ASP.NET ViewState Deserialization (May 28, 2025)
• Exploit #11341 - CVE-2025-30406 (April 25, 2025)

External References

• https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf
• https://www.centrestack.com/p/gce_latest_release.html

Related Security Bulletins

• Remote code execution in Gladinet CentreStack