CVE‑2025‑30406: Hard‑coded Cryptographic Key in Gladinet CentreStack & Triofox Enables Remote Code Execution
What It Is – Gladinet CentreStack and its Triofox front‑end embed a hard‑coded cryptographic key that is used to protect ViewState integrity. The static key lets an attacker craft malicious ViewState payloads that survive integrity checks and are deserialized on the server, leading to remote code execution.
Exploitability – The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating that exploit code is known to be in the wild. CVSS v3.1 scores it at 9.8 (High).
Affected Products – Gladinet CentreStack (on‑premises and cloud‑hosted deployments) and the Triofox web interface that ships with the same code base.
Why It Matters for Trust & Control Assurance
- Cryptographic key management – Hard‑coded secrets violate the control objective of protecting cryptographic keys and application secrets, a requirement across SOC 2, ISO 27001, NIST CSF and many other frameworks.
- Continuous control monitoring – Detecting static keys requires evidence‑driven monitoring of code repositories and runtime configurations; without it, organizations cannot demonstrate due‑diligence during audits.
- Defensible audit trail – Remediating the flaw and documenting key rotation provides the audit‑ready artifacts buyers now demand when evaluating SaaS providers.
Recommended Actions
- Inventory all Gladinet CentreStack/Triofox instances and verify the version.
- Apply vendor patch as soon as it is released; if unavailable, implement a temporary mitigation by disabling ViewState or enforcing server‑side encryption with a managed key.
- Rotate any static keys used for ViewState integrity and replace them with keys stored in a centralized, hardware‑backed key management service (KMS).
- Update control evidence – capture screenshots of key‑management policies, KMS integration logs, and patch‑deployment records for audit purposes.
- Integrate into continuous monitoring – add a rule to your configuration‑as‑code scans that flags hard‑coded secrets in deployed artifacts.
Source: CISA KEV – CVE‑2025‑30406