Known Exploited Vulnerabilities April 08, 2025 · CISA KEV Catalog

CVE-2025-30406: Gladinet Centre Stack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

Summary: Gladinet CentreStack and Triofox contain a hard-coded cryptographic key vulnerability in how the application manages keys used for ViewState integrity verification. Successful exploitation lets an attacker forge ViewState payloads for server-side deserialization, enabling remote code execution.
What's compelling: A hard-coded key means the integrity check on ViewState can be forged by anyone who knows it, and CISA's remediation due date of 2025-04-29 leaves little room to treat this as routine patching.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-30406 Gladinet
Related: CVE-2025-14611: Gladinet Centre Stack and Triofox Hard Coded Cryptographic Vulnerability Known Exploited Vulnerabilities · Dec 15, 2025
CVE-2025-12480: Gladinet Triofox Improper Access Control Vulnerability Known Exploited Vulnerabilities · Nov 12, 2025
CVE-2025-11371: Gladinet Centre Stack and Triofox Files or Directories Accessible to External Parties Vulnerability Known Exploited Vulnerabilities · Nov 04, 2025